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What GAO Found 


The Department of Homeland Security’s (DHS) U.S. Immigration and Customs 
Enforcement (ICE) has identified several fraud risks to the Student and 
Exchange Visitor Program (SEVP). As shown in the figure below, these include 
risks associated with school owners and designated school officials (DSO) who 
help ICE oversee students in the program. These fraud risks may occur as 
schools apply to become SEVP-certified, accept foreign students, and apply for 
recertification every 2 years. 


Key Areas of Potential Fraud in the Student and Exchange Visitor Program (SEVP) 
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Source: GAO analysis of SEVP information. | GAO-19-297 


school or self during the 
recertification process. 


ICE has implemented controls to address fraud risks related to school 
certification, but long-standing delays in recertifying these schools exacerbate 
fraud risks. By statute and regulation, ICE must conduct recertification reviews 
every 2 years to ensure that schools continue to meet program requirements— 
an important fraud risk control. Between 2013 and 2017, ICE recertified about 
12,900 schools. However, according to ICE officials, they have been unable to 
meet the 2-year time frame and, as of June 2018, had 3,281 recertification 
petitions waiting for review. To help manage its queue, ICE has lengthened the 
period between recertification reviews by extending schools’ certification 
expiration dates by 180 days, which is inconsistent with its regulation and may 
allow fraudulent schools to operate longer without detection. Although ICE is 
taking steps to increase resources for recertification, it is unclear whether these 
steps will ensure recertification is conducted consistently with ICE regulations. 


ICE relies on DSOs to, among other things, update and maintain foreign-student 
data in ICE’s foreign-student information system and report suspected fraud to 
ICE. However, ICE does not provide DSOs with training that addresses fraud 
risks to the program. In June 2018, ICE officials stated that they plan to develop 
this fraud training for DSOs, but do not have documented plans or timelines for 
when it would be completed. By developing these plans, the agency would be 
better positioned to ensure that DSOs receive the training needed to address 
potential fraud in the program. 
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i U.S. GOVERNMENT ACCOUNTABILITY OFFICE 
441 G St. N.W. 
Washington, DC 20548 


March 18, 2019 
Congressional Requesters 


As of March 2018, more than 1.2 million foreign students in the United 
States were enrolled in 8,744 schools approved to participate in the 
Department of Homeland Security's (DHS) Student and Exchange Visitor 
Program (SEVP). DHS’s U.S. Immigration and Customs Enforcement 
(ICE) is responsible for managing SEVP, which certifies schools 
authorized to enroll foreign students in academic and vocational 
programs, and oversees such schools and students.' We previously 
reported that foreign students bring needed skills to an increasingly 
knowledge-based economy and make other valuable contributions to 
society, but have also reported on fraud risks posed by SEVP-certified 
schools and foreign students in the United States.” 


In our 2011 and 2012 reports on student visas, we identified instances in 
which fraudulent schools exploited the U.S. immigration system by 
knowingly reporting to SEVP that foreign students were fulfilling their 
immigration status requirements, such as maintaining a full course load, 
when they were not attending school or were attending intermittently. In 
addition, we reported that terrorist attacks in the United States have 
pointed to the need for close monitoring and oversight of foreign 


‘“SEVP-certified schools” span all education levels from kindergarten to secondary 
education, as well as postsecondary academic, vocational, English language, and flight 
schools. SEVP certifies schools for the enrollment of F and M nonimmigrants who come to 
the United States on a temporary basis to engage in an approved course of study and 
who are referred to in this report as “foreign students.” F visas are for foreign students 
pursuing academic studies at a college, university, or other academic institution, or in an 
accredited language-training program. 8 U.S.C. § 1101(a)(15)(F); 8 C.F.R. § 214.2(f). M 
visas are for foreign students pursuing studies at an established vocational or other 
recognized nonacademic institution. 8 U.S.C. § 1101(a)(15)(M); 8 C.F.R. § 214.2(m). In 
addition, ICE manages the Student and Exchange Visitor Information System (SEVIS), 
which assists the agency in tracking and monitoring certified schools, as well as providing 
oversight of students and their dependents while they are approved to participate in U.S. 
educational institutions. 


2GAO, Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting 
Export-Controlled Information at Universities, GAO-07-70 (Washington, D.C.: Dec. 5, 
2006). 
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students.° For example, one of the September 11, 2001, terrorists 
entered the country on a student visa and subsequently attended flight 
schools. We also found that ICE had not developed a process to identify 
and analyze program risks. Further, we found that ICE did not 
consistently implement internal controls to verify schools’ legitimacy and 
eligibility, such as independently verifying state licensure and 
accreditation documentation, during initial SEVP certification and once 
schools begin accepting foreign students.* In our 2012 report, we 
recommended that ICE take actions to improve the identification and 
assessment of risks in SEVP and to consistently implement procedures 
for ensuring schools meet the criteria for SEVP certification, among other 
things. ICE concurred with the recommendations and, in response, took 
action to address them, such as by developing and institutionalizing a 
risk-management process and improving controls over the program. 
Appendix | presents additional details on the recommendations in our 
2012 report and actions taken by ICE to address those recommendations. 


SEVP and the Counterterrorism and Criminal Exploitation Unit (CTCEU), 
within ICE, have a role in preventing, detecting, and responding to 
potential fraud in SEVP.° Regarding certified schools, SEVP develops 
and implements controls to monitor school compliance with the program, 
including controls designed to prevent and detect potential fraud; provides 
support to the schools; and conducts reviews to assess schools’ 
continued eligibility to enroll foreign students. In addition, SEVP is 
responsible for the oversight of foreign students while they are in the 
United States to ensure that they comply with the terms of their admission 
into the country. SEVP does so, in part, by approving individuals 


3GAO, Overstay Enforcement: Additional Mechanisms for Collecting, Assessing, and 
Sharing Data Could Strengthen DHS’s Efforts but Would Have Costs, GAO-11-411 
(Washington, D.C.: Apr. 15, 2011); and Student and Exchange Visitor Program: DHS 
Needs to Assess Risks and Strengthen Oversight Functions, GAO-12-572 (Washington, 
D.C.: June 18, 2012). 


4A legitimate and eligible school is one that has established, at the time of filing, that it is a 
bona fide and established institution of learning or other recognized place of study that 
has the necessary facilities, personnel, and finances to conduct instruction in recognized 
courses, and is in fact engaged in instruction in those courses. See 8 C.F.R. § 214.3(a)(3). 


5Fraud involves obtaining something of value through willful misrepresentation (see 
GAO-14-704G for discussion on types of fraud). Whether an act is fraudulent, under 
relevant law, is a determination to be made through the judicial or other adjudicative 
system and is beyond management's professional responsibility for assessing risk. For the 
purposes of this report, fraud refers to any form of immigration-related or other fraud such 
as willful misrepresentations or false statements that may pose a risk to SEVP integrity. 
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nominated by their employing schools to serve as Designated School 
Officials (DSO). DSOs are responsible for entering and maintaining 
students’ complete information in a timely manner, such as by entering 
information on courses of study and attendance in ICE’s Student and 
Exchange Visitor Information System (SEVIS). In addition, CTCEU is 
responsible for, among other things, combating the criminal exploitation of 
the foreign-student visa system, including through coordination with 
SEVP. In this role, CTCEU tracks, coordinates, and oversees criminal 
investigations in response to potential cases of fraud in the program. 


You asked us to review potential vulnerabilities to fraud in SEVP. This 
report examines efforts that ICE has taken since our 2012 report to 
address fraud risks. Specifically, we examine the extent to which ICE has 


e taken steps to strengthen its management of fraud risks in SEVP, 


e implemented controls to address fraud risks in the school certification 
and recertification processes, and 


e implemented fraud risk controls related to the eligibility, suitability, and 
training of DSOs. 


This report is a public version of a sensitive report that we issued on 
November 20, 2018, which included sensitive information related to SEVP 
internal controls used to help prevent and identify noncompliance or fraud 
in the program.® The sensitive report also discussed some planned 
actions to improve these internal controls, some of which DHS deemed to 
be sensitive and must be protected from public disclosure. This public 
report omits the information that DHS deemed to be sensitive including 
some details associated with (1) the oversight of schools during the 
certification and recertification process, (2) our covert testing of SEVP 
certification internal controls, and (3) current and planned actions to 
oversee DSOs. Although the information provided in this report is more 
limited, it addresses the same objectives and uses the same methodology 
as the sensitive report. 


To evaluate the extent to which ICE has taken steps to strengthen its 
management of fraud risks, we analyzed documentation ICE officials 
provided regarding risks, vulnerabilities, and past cases of SEVP-related 


®GAO, Student and Exchange Visitor Program: DHS Can Take Additional Steps to 
Manage Fraud Risks Related to School Recertification and Program Oversight, 
GAO-19-133SU (Washington, D.C.: Nov. 20, 2018). 
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fraud. We reviewed documentation such as ICE’s Risk Assessment 
Model and Framework and information on schools that ICE has identified 
as potentially noncompliant or fraudulent. We compared ICE’s fraud risk 
management practices to GAO’s A Framework for Managing Fraud Risks 
in Federal Programs (Fraud Risk Framework), which provides a 
comprehensive set of key components and leading practices that serve 
as a guide for agency managers to use when developing efforts to 
combat fraud in a strategic, risk-based way.’ We also used agency data 
on certified schools as of September 2017 to conduct a “network 
analysis’—a quantitative approach to identifying and graphically 
representing potentially unknown relationships among individuals or 
organizations—to determine whether ICE could use this technique to help 
identify connections between potentially fraudulent actors in the program. 
To further validate this information, we conducted additional research 
using investigative databases and public information to try to verify the 
instances identified in our analysis. 


To evaluate the extent to which ICE has implemented controls to address 
fraud risk in the school certification and recertification processes, we 
reviewed documentation describing ICE’s certification and recertification 
controls and analyzed ICE-provided recertification data. Specifically, we 
assessed ICE’s standard operating procedures, adjudicator guidance, 
training materials, and other guidance to determine whether the 
certification and recertification controls described in these documents 
addressed the high-risk indicators ICE has identified. We also compared 
ICE’s controls in these areas to GAO’s Standards for Internal Control in 
the Federal Government (Federal Internal Control Standards) related to 
risk management, as well as principles of the Fraud Risk Framework.® 


We also conducted covert testing of SEVP’s internal control activities 
related to the school certification process. Specifically, we submitted 
certification petitions and conducted other covert investigative work for 
three fictitious schools and petitioned to obtain SEVP certification. For the 
first school, among other things, we submitted incomplete documentation 
to SEVP. For the second school, among other things, we submitted 
complete documentation, but we did not schedule a site visit as directed 


7GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP 
(Washington, D.C.: July 2015). 


8GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 
(Washington, D.C.: September 2014) and GAO-15-593SP. 
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by SEVP. Site visits are visits to the petitioning school by SEVP staff to, 
among other things, interview school officials and review the facilities. For 
our third school, among other things, we completed the petition for 
certification and submitted it to SEVP, and participated in a site visit with 
SEVP officials using a rented space as a fictitious school location. For all 
three petitions, we used publicly available information to construct our 
scenarios. We also used publicly available hardware, software, and 
materials to produce counterfeit or fictitious documents, which we 
submitted, as appropriate for our testing. We then documented any 
actions taken by SEVP on the submitted petitions, such as requests to 
provide additional supporting documentation, among other potential 
actions. Results for all three covert tests, while illustrative, cannot be 
generalized to the full population of petitioners. 


To determine the extent to which ICE has implemented fraud risk controls 
related to the eligibility, suitability, and training of DSOs, we analyzed 
documentation on DSO eligibility, current and planned DSO background 
checks,° and DSO roles and requirements, including training. We 
assessed the implementation of these controls against criteria in Federal 
Internal Control Standards and the Fraud Risk Framework. Also, we 
reviewed documentation on the current and planned DSO background 
checks, including existing procedures for DSO vetting and initial 
requirements and a draft policy for future enhancements to such checks. 
We compared these documents to leading practices for project planning 
in the Project Management Institute’s A Guide to the Project Management 
Body of Knowledge.'° We also compared these documents to our 
Schedule Assessment Guide." 


In addition, to address each objective, we interviewed officials from 
SEVP’s Risk Management Support, School Certification, Policy, Analysis 
and Operations Center, and Field Representative Units to discuss their 
involvement in addressing fraud risk. We also interviewed ICE’s 
Homeland Security Investigations Special Agents (ICE agents) from 


°For the purposes of this report, we refer to the actions taken by ICE to determine the 
suitability of prospective DSOs for the position, including granting them access to SEVIS, 
as “background checks.” 


‘Project Management Institute, A Guide to the Project Management Body of Knowledge 
(PMBOK® Guide), Sixth Edition (2017). PMBOK is a trademark of Project Management 
Institute, Inc. 


1GAO, Schedule Assessment Guide: Best Practices for Project Schedules, GAO-16-89G 
(Washington, D.C.: December 2015). 
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headquarters and 5 of ICE’s 26 field offices, a process that allowed us to 
obtain their perspectives on fraud risks in the program. '? We selected 
these offices based on their experience in investigating previous cases of 
school or student-related fraud, among other considerations. In addition, 
we interviewed eight SEVP field representatives whose areas of 
responsibility include California, New Jersey, and New York to gather 
information on representatives’ roles and activities identifying and 
reporting potential school and student-related fraud or noncompliance. 
We selected these representatives based on their proximity to the ICE 
field offices we visited. 


As part of our site visits, we also interviewed DSOs at 17 SEVP-certified 
schools on their roles, responsibilities, and training. We selected these 
officials because, as of September 2017, they represented a group of 
officials from SEVP-certified schools of various types and sizes and were 
located in proximity to our selected ICE field-office locations. As we did 
not select a probability sample of ICE field offices, field representatives, 
or DSOs to interview, the information from these individuals cannot be 
generalized but provided us with useful insights into previous cases of 
known or suspected fraud or noncompliance and the role of both the field 
representatives and the DSOs. Appendix II presents more detail about 
our scope and methodology. 


The performance audit upon which this report is based was conducted 
from May 2017 to November 2018 in accordance with generally accepted 
government auditing standards. Those standards require that we plan 
and perform the audit to obtain sufficient, appropriate evidence to provide 
a reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a reasonable 
basis for our findings and conclusions based on our audit objectives. This 
report is also based on related investigative work conducted from 
September 2017 to September 2018 in accordance with standards 
prescribed by the Council of the Inspectors General on Integrity and 
Efficiency. 


'2We interviewed officials from ICE’s Homeland Security Investigations field offices in 
Washington, D.C.; San Francisco and Los Angeles, California; Newark, New Jersey; and 
New York, New York. 
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i ee 


Background 


Student Visa and School 
Certification Process 


Foreign students interested in studying in the United States must first be 
admitted to an SEVP-certified school or university before applying for a 
nonimmigrant visa at a U.S. embassy or consulate overseas to authorize 
travel to the United States. '* A visa holder must present himself or herself 
for inspection at a U.S. port of entry by an officer with DHS’s U.S. 
Customs and Border Protection to determine admissibility. '* 
Nonimmigrants, including foreign students, are permitted to enter the 
United States for an authorized period of stay."® 


Schools seeking to enroll foreign students on F and M visas must pay an 
application fee and petition for SEVP certification by submitting an 
electronic certification petition and supporting documentation to ICE 


*3Nonimmigrant visas are issued to foreign nationals seeking temporary admission into the 
United States under a specific nonimmigrant category (8 U.S.C. § 1101(a)(15); 8 C.F.R. § 
214.1(a)(1)-(2)), for an authorized period of stay delineated by a particular time frame; or, 
as is generally the case with foreign students and exchange visitors, “duration-of-status” 
(i.e., admission for the time span of a specific program or activity, which may be variable), 
provided that in either instance the individual is in compliance with the conditions of his or 
her admission during his or her stay. A visa is not required for travel to the United States 
by citizens of Canada, as well as participants in the Visa Waiver Program, through which 
nationals of certain countries may apply for admission to the United States as temporary 
visitors for business or pleasure without first obtaining a visa from a U.S. embassy or 
consulate abroad. See 8 U.S.C. § 1187; 8 C.F.R. §§ 212.1, 214.6(d), 217.1-217.7; 22 
C.F.R. §§ 41.0-41.3. If a foreign national in nonimmigrant status fails to comply with the 
terms of admission during his or her authorized period of stay, or remains in the United 
States longer than authorized without obtaining an extension or other valid immigration 
status or protection, such individual may be subject to administrative enforcement and 
removal from the United States. 


“4See 8 U.S.C. §§ 1185 (U.S. travel controls), 1225 (immigration inspections of applicants 
for admission); 19 U.S.C. §§ 1461, 1467 (customs inspections of persons, merchandise 
and baggage). A port of entry is any officially designated location (seaport, airport, or land 
border location) where DHS officers or employees are assigned to clear passengers and 
merchandise, collect duties, and enforce customs laws, and where DHS officers inspect 
persons entering or applying for admission into, or departing, the United States pursuant 
to U.S. immigration and travel controls. 


‘SThe authorized period of stay is the fixed or variable amount of time for which a 
nonimmigrant is admitted to the United States upon inspection by a U.S. Customs and 
Border Protection officer at a U.S. port of entry. Students may seek an F visa for academic 
study at 2- and 4-year colleges and universities and other academic institutions. 8 U.S.C. 
§ 1101(a)(15)(F); 8 C.F.R. § 214.2(f). Alternatively, students may seek an M visa for 
vocational or other nonacademic study at certain institutions, such as technical schools. 8 
U.S.C. § 1101(a)(15)(M); 8 C.F.R. § 214.2(m). 
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through SEVIS. Among other things, SEVIS assists ICE in tracking and 
providing oversight of foreign students—while they are approved to study 
in SEVP-certified U.S. educational institutions—and their accompanying 
dependents. '® Figure 1 outlines the steps required for schools seeking to 
obtain and maintain SEVP certification and the process for foreign 
nationals to pursue a course of study in the United States. 


‘6The Form I-17 is the Petition for Approval of School for Attendance by Nonimmigrant 
Student. 
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Figure 1: Life Cycle of Student and Exchange Visitor Program (SEVP)-Certified Schools and Foreign Students 


SEVP School 
(Ox-Vutiicershite) a] 


Life Cycle 


Initial Application 
School pays fee and 
electronically submits 
certification application, 
including supporting 
documentation. 


Adjudication 

SEVP reviews application 
and evidence, assesses 
designated school official’s 
eligibility, and conducts 

a site visit. 


Certification Decision 
School is certified by SEVP, 
if eligible. 


Student Enrollment 
School may enroll foreign 
students, including transfer 
students from other 
certified schools. 


Recertification 
School petitions for 
recertification every 
2 years. 


oO 


Be 


Foreign Student Life Cycle 


Foreign nationals 
interested in 
coming to the 
United States 

to engage 

in academic, 
vocational, or 
other nonacademic 
studies must first 
apply to, and be 
accepted by, 

an SEVP-certified 
school or university. 


Source: GAO analysis of SEVP information. | GAO-19-297 


Obtain an 

initial Form I-20, 
“Certificate of 
Eligibility for 
Nonimmigrant 
Student Status,” 
from school. 


If abroad, apply 
for an F-1 
academic or 
M-1 vocational 
study visa 
through a U.S. 
embassy or 
consulate.? 


After visa 
issuance, be 
admitted ata 
U.S. port of 
entry, and 
register for 

a program 
of study.” 


Students remain 
“in status” and 
therefore may 

stay in the United 
States as long as 
they do not violate 
terms of admission. 
Foreign students 
must meet school 
attendance and 
other requirements 
and may seek 
transfer admission 
to another SEVP- 
certified school. 


Depart the United 
States by the 
expiration of 
authorized period 
of stay, after 
completing the 
program of 

study or practical 
training, or receive 
approval for an 
extension of 
status ora 
change in status 
to another 
nonimmigrant or 
immigrant status. 


“If in the United States under other valid nonimmigrant status, apply to U.S. Citizenship and 
Immigration Services to change to F or M status. 
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"Those changing status within the country must have their application approved by U.S. Citizenship 
and Immigration Services before registering for their program of study. 


More specifically, during the initial certification process, a school must 
provide ICE, specifically SEVP’s School Certification Unit (Certification 
Unit), with evidence of the school’s legitimacy (or bona fides) and 
eligibility. 7 Such evidence includes the following: 


e proof of any requisite licensure or approval by an appropriate state- 
level licensing or approving agency; "® 


e proof of accreditation by an accrediting agency recognized by the 
Department of Education, if accreditation is required or otherwise 
claimed; '9 


e DSO’s attestation statement that he or she is familiar, and intends to 
comply, with program rules and regulations for admission under, and 
maintenance and change of, nonimmigrant student status; and 
confirmation by the school that it is eligible for certification, among 
other things (willful misstatements in a school certification petition may 
constitute perjury);2° and 


e DSOs'’ proof of U.S. citizenship or lawful permanent residency.”' 


'7To be eligible for SEVP certification, a petitioning school must present evidence at the 
time of filing demonstrating that the school is legitimate, that is, a bona fide and 
established institution of learning or other recognized place of study; possesses the 
necessary facilities, personnel, and finances to conduct instruction in recognized courses; 
and is in fact engaged in instruction in those courses. See 8 C.F.R. § 214.3(a)(3). For the 
purposes of this report, we refer to such bona fide and established institutions of learning 
or other recognized places of study as legitimate. 


‘8A school other than a public educational institution or system, or a private or parochial 
elementary or secondary school system, must submit a certification by the appropriate 
licensing, approving, or accrediting official stating that the school is licensed, approved, or 
accredited, as appropriate. To fulfill this requirement, schools may also provide proof of 
exemption from state licensure requirements. 8 C.F.R. § 214.3(b). 


19| anguage-training programs must be accredited by an accrediting agency recognized by 
the Department of Education. 8 U.S.C. § 1101(a)(15)(F)(i), (a)(52). The goal of 
accreditation is to ensure that the education provided by institutions of higher learning 
meets acceptable levels of quality. Accrediting agencies, which are private educational 
associations of regional or national scope, develop evaluation criteria and conduct peer 
evaluations to assess whether or not those criteria are met. Institutions or programs that 
request an agency’s evaluation and that meet an agency’s criteria are then “accredited” by 
that agency. 


208 C.F.R. § 214.3(a)(1)(ii), (I). 
21See id., § 214.3(I)(1)(i). 
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In addition, petitioning schools must generally submit a school catalog or 
written statement including certain information with respect to the 
qualifications of teaching staff, and attendance and grading policies, 
among other things. However, the requirement for a school catalog or 
written statement is not applicable to a public school or school system, a 
school accredited by a Department of Education—recognized accrediting 
agency, or a secondary school operated by or as part of such an 
accredited school.?? Moreover, an institution of higher education that is 
not a public educational institution or system, or not accredited by a 
recognized accrediting body, must provide evidence “in lieu of’ meeting 
those criteria. Such evidence must show either that the school of higher 
learning confers recognized degrees upon its graduates or its credits 
have been and are unconditionally accepted by at least three public or 
accredited institutions of higher education.”° 


Schools nominate individuals to serve as DSOs, who act as liaisons 
between foreign students, the DSOs’ employing school, and federal 
government agencies. DSOs support school compliance with record- 
keeping, reporting, and other requirements, and provide 
recommendations to foreign students regarding the maintenance of their 
immigration status. In addition to entering and maintaining complete 
information on students in SEVIS in a timely manner, DSOs are 
responsible for using SEVIS to submit their school’s certification petition 
and update the information, as necessary. To demonstrate eligibility, 
DSOs must, among other things, provide to ICE statements certifying 
their familiarity and intent to comply with the program rules and 
regulations relating to the requirements for nonimmigrant students’ 
admission, maintenance of status, and change of status, and 
requirements for school approval. ICE’s regulations provide that willful 


72ICE’s regulations use the term “nationally recognized accrediting body” in reference to a 
Department of Education— recognized accrediting agency. See 8 C.F.R. § 214.3(b). 


238 C.F.R. § 214.3(c). Subsection (c) also provides that vocational, business, or language 
schools, or American research institutions recognized by the Secretary of Homeland 
Security, must submit evidence that their courses of study fulfill an educational, 
professional, or vocational objective, and are not avocational or recreational in nature. In 
addition, an elementary or secondary school that does not qualify as either a public 
educational institution or system, or a secondary school operated by or as part of a 
nationally accredited school, must submit evidence that attending the school satisfies the 
mandatory attendance requirements of the state in which it is located and that the school 
qualifies graduates for acceptance by schools of a higher educational level within 
particular categories. 
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misstatements in certification and recertification submissions may 
constitute perjury.”4 


Once ICE has received a complete petition from a school seeking SEVP 
certification, staff from SEVP’s Field Representative Unit are to conduct a 
site visit to the school, including each instructional site foreign students 
will attend, to interview school officials and review the facilities. After 
receiving all necessary evidence and a site-visit report from the field 
representatives, ICE staff in the Certification Unit analyze the 
documentation, determine the school’s eligibility, and certify those 
schools that they determine meet all of the program’s requirements. 


Further, DHS is required to conduct a review, every 2 years, of certified 
schools’ continued eligibility and compliance with the program’s 
requirements.*° To be eligible for recertification, an SEVP-certified school 
must demonstrate at the time of filing that it remains eligible for 
certification and has complied during its previous period of certification or 
recertification with record-keeping, retention, reporting, and other program 
requirements.”° During the recertification process, the Certification Unit 
requires schools to submit the same type of evidence that was required 
for certification, including, among other things, proof of state licensing and 
accreditation and DSO attestation statements and citizenship 
documentation.’ The Certification Unit also evaluates how the school has 
ensured that its foreign-student records are accurate and in compliance 


248 C.F.R. § 214.3(a)(1)(ii). 


*5The Enhanced Border Security and Visa Entry Reform Act of 2002 requires DHS to 
conduct periodic compliance reviews every 2 years to determine SEVP-certified schools’ 
continued eligibility and compliance with the program’s requirements. Pub. L. No. 107- 
173, tit. V, § 502, 116 Stat. 543, 563 (classified at 8 U.S.C. § 1762). See also 8 C.F.R. § 
214.3(e)(2) (certification must be recertified every 2 years and may be subject to out-of- 
cycle review at any time); Adjusting Program Fees and Establishing Procedures for Out- 
of-Cycle Review and Recertification of Schools Certified by the Student and Exchange 
Visitor Program To Enroll F and/or M Nonimmigrant Students, 73 Fed. Reg. 55,683 (Sept. 
26, 2008) (codified at 8 C.F.R. pts. 103 and 214) (SEVP stated that it could not implement 
a commenter’s 5-year recertification proposal because 2-year certification is mandated by 
law); Requiring Certification of all Service Approved Schools for Enrollment in the Student 
and Exchange Visitor Information System (SEVIS), 67 Fed. Reg. 60,107 (Sept. 25, 2002) 
(struck a provision relating to indefinite approval and clarified that schools are to be 
approved every 2 years). 


268 C.F.R. § 214.3(a)(3)(ii). 


278 C.F.R. § 214.3. Schools will be notified 180 days before their certification expiration 
date, and must file a completed petition before such date, which is 2 years from the 
previous certification or recertification expiration date. 
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Fraud Risk-Management 
Leading Practices and 
Requirements 


with statutory record-keeping requirements. However, site visits are not 
required for recertification. 


The Enhanced Border Security and Visa Entry Reform Act of 2002 states 
that a material failure of an SEVP-certified school to comply with the 
record-keeping and reporting requirements to receive foreign students 
shall result in the suspension for at least 1 year, or termination, of the 
school’s approval to receive such students.2® SEVP’s Analysis and 
Operations Center (Compliance Unit) conducts ongoing monitoring of 
SEVP-certified schools for compliance with these regulatory record- 
keeping and reporting requirements, as well as schools’ continued 
eligibility for certification. Under federal regulation, SEVP can deny an 
SEVP-certified school’s recertification petition or, subsequent to out-of- 
cycle review, withdraw certification if the school or its programs are no 
longer eligible for certification.2° Denial of recertification or withdrawal on 
notice as a result of out-of-cycle review may be for any valid and 
substantive reason, including failure to comply with record-keeping and 
reporting requirements, willful issuance by a DSO of a false statement, or 
not operating as a bona fide institution of learning, among other bases.°° 


According to federal standards and guidance, executive-branch agency 
managers are responsible for managing fraud risks and implementing 
practices for combating those risks.*' Federal internal control standards 
call for agency management officials to assess the internal and external 
risks their entities face as they seek to achieve their objectives. The 
standards state that, as part of this overall assessment, management 


288 U.S.C. § 1762. 
298 C.F.R. §§ 214.3(e)(5), (h)(2), (h)(3), 214.4(a), (b). 


398 C.F.R. § 214.4(a). The regulation provides that a school’s recertification petition may 
be denied or certification may be withdrawn on notice (after out-of-cycle review), “if the 
school or school system is determined to no longer be entitled to certification for any valid 
and substantive reason including, but not limited to, the following” listed grounds. Id. 


31Fraud in the immigration context may result in various statutory violations. See, for 
example, 18 U.S.C. ch. 47 (fraud and false statements), in particular § 1001 (criminal 
penalties for false statements and concealment before any U.S. government entity); 18 
U.S.C. §§ 1541-1547 (criminal penalties for immigration-related fraud); 18 U.S.C. § 1621 
(criminal penalties for perjury); 8 U.S.C. §§ 1182(a)(6)(C)(i), (a)(6)(F), 1227(a)(1)(A), 
(a)(1)(B), (a)(3)(C)(i) (grounds of removability for fraud or willful misrepresentations), 
1324c (civil penalties for immigration-related document fraud and criminal penalties for not 
disclosing role as document preparer). 
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should consider the potential for fraud when identifying, analyzing, and 
responding to risks.** Risk management is a formal and disciplined 
practice for addressing risk and reducing it to an acceptable level.*° In 
July 2015, we issued the Fraud Risk Framework, which provides a 
comprehensive set of key components and leading practices that serve 
as a guide for agency managers to use when developing efforts to 
combat fraud in a strategic, risk-based way.** The Fraud Risk Framework 
describes leading practices in four components: commit, assess, design 
and implement, and evaluate and adapt, as depicted in figure 2. 


32GAO-14-704G. 


33MITRE, Government-wide Payment Integrity: New Approaches and Solutions Needed 
(McLean, Va.: February 2016). 


34GA0-15-593SP. 
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Figure 2: GAO’s Fraud Risk-Management Framework 
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Source: GAO. | GAO-19-297 
The Fraud Reduction and Data Analytics Act of 2015, enacted in June 


2016, requires the Office of Management and Budget (OMB), in 
consultation with the Comptroller General of the United States, to 
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establish guidelines for federal agencies to create controls to identify and 
assess fraud risks and design and implement antifraud control activities.* 
The act further requires OMB to incorporate the leading practices from 
the Fraud Risk Framework in the guidelines. In July 2016, OMB published 
guidance about enterprise risk management and internal controls in 
federal executive departments and agencies.*° Among other things, this 
guidance affirms that managers should adhere to the leading practices 
identified in the Fraud Risk Framework. Further, the act requires federal 
agencies to submit to Congress a progress report each year for 3 
consecutive years on the implementation of the controls established 
under OMB guidelines, among other things. 


ICE Has 
Strengthened Fraud 
Risk Management for 
SEVP but Has Not 
Fully Developed a 
Fraud Risk Profile or 
Employed Certain 
Data Tools That Can 
Help Guide Its Efforts 


ICE Has Taken Steps to 
Enhance Fraud Risk 
Management 


ICE developed a risk-assessment framework and other tools to assist in 
its efforts to manage fraud risks to SEVP. For example, in 2014, ICE 
began developing an SEVP Risk Assessment Model and Framework, 
which provides an overview of how SEVP identifies, assesses, responds 
to, and reports on identified internal and external risks to the program. 
Specifically, SEVP’s Risk Assessment Model and Framework—which 
was updated several times between 2014 and 2017—discusses 
categories of fraud risks to the program, including fraud associated with 


35Fraud Reduction and Data Analytics Act of 2015, Pub. L. No. 114-186, § 3, 130 Stat. 
546-47. 


36Office of Management and Budget, Management’s Responsibility for Enterprise Risk 
Management and Internal Control, Circular No. A-123 (July 15, 2016). 
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schools, DSOs, and students. Moreover, in 2014, ICE developed a Risk 
Assessment Tool for SEVP that uses data from SEVIS records to identify 
potential fraud and other noncompliance issues among certified schools. 
The tool prioritizes different risk indicators—such as the proportion of the 
school that consists of foreign students—and ranks schools by risk level. 
SEVP officials stated that schools identified as high risk receive additional 
administrative review by the Compliance Unit. According to SEVP officials 
and documentation we reviewed, ICE has continued to update and refine 
the tool since 2014 to improve its effectiveness in helping to identify 
program risks, including fraud risks. 


Through these and its oversight efforts, ICE has identified various fraud 
risks in SEVP; such risks may take various forms, including immigration 
benefit fraud, which involves the willful or knowing misrepresentation of 
material facts for the purpose of obtaining an immigration benefit, such as 
a nonimmigrant student status, without lawful entitlement.?” According to 
ICE documentation we reviewed and officials we spoke to, the fraud risks 
to the program generally fall into four broad categories: schools, students, 
DSOs, and third-party brokers, who are individuals engaged in the fee- or 
commission-based recruitment of foreign students, among other activities. 
Figure 3 illustrates the types of fraud that may occur in these four 
categories during different stages of a certified school’s involvement in 
the program, as we identified in ICE documentation and through our 
interviews with ICE officials. 


37Such misrepresentations may involve a specific intent to deceive. Immigration benefit 
fraud is often facilitated by document fraud and identity fraud. Immigration-related 
document fraud includes forging, counterfeiting, altering, or falsely making any document, 
or using, possessing, obtaining, accepting, or receiving such falsified documents in order 
to satisfy any requirement of, or to obtain a benefit under, the Immigration and Nationality 
Act. Identity fraud refers to the fraudulent use of others’ valid documents. 
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Figure 3: Areas of Potential Fraud Related to the Life Cycle of a Student and Exchange Visitor Program (SEVP)-Certified 
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For specific examples of fraud risks that ICE has identified in SEVP, see 
figure 4. 


Figure 4: Potential Fraud Schemes and Examples of Fraud in the Student and Exchange Visitor Program (SEVP) 
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continued to collect millions of dollars in tuition from foreign 
students who did not attend class. 


As part of the Micropower Career Institute case, the government 
indicted three DSOs working for the school for crimes related to 
the failure to report students who were noncompliant with the 
terms of their nonimmigrant student status, among other things, 
to the government. In other instances, DSOs may have acted 
independently from their schools. For example, in December 
2017, a DSO at a university in Pennsylvania was indicted for 
allegedly falsely reporting foreign national enrollment status at 
this school. 


In 2016, as part of an ICE undercover investigation in which ICE 
agents created a fake school, the University of Northern New Jersey, 
ICE indicted 21 brokers who were attempting to help enroll foreign 
students in fake courses of study for commissions. In other cases, 
brokers have obtained and stolen funds from students meant to pay 
school or SEVP-related fees. For example, SEVP officials noted that 
in some cases brokers will request payments from students for 
SEVP-related fees and then misuse or steal the funds. 


As part of its University of Northern New Jersey undercover 
investigation, ICE identified approximately 1,070 foreign individuals 
who sought to maintain their nonimmigrant status in the United 
States on the false pretense that they continued to participate in full 
courses of study. The school was not staffed with instructors or 
educators, had no curriculum, and conducted no actual classes or 
educational activities. 
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ICE has also taken steps since 2012 to strengthen its fraud risk- 
management efforts in response to our prior recommendations. For 
example, in our 2012 report on SEVP risks, we found that, among other 
things, ICE did not have a process to assess risks in SEVP and did not 
consistently implement existing internal controls for determining school 
eligibility. To address this and other findings, we made eight 
recommendations to enhance ICE’s ability to assess program risks, 
prevent and detect school certification fraud, and improve the controls 
over SEVP. ICE took action that addressed these eight recommendations 
and has developed various tools designed to strengthen its fraud risk- 
management efforts (see app. 1). 


Further, ICE has taken steps to improve collaboration and coordination to 
enhance fraud risk management between SEVP and CTCEU, the unit 
within ICE responsible for managing criminal investigations. More 
specifically, ICE has embedded agents within SEVP’s Compliance Unit, 
and these agents help provide law-enforcement expertise within the unit 
and act as liaisons with ICE agents located in the field to provide 
information and support ongoing criminal investigations. According to a 
senior ICE official with CTCEU, the embedded agents have helped 
streamline processes and provide expertise to aid administrative and 
investigative efforts. Figure 5 shows the process for coordination between 
CTCEU and SEVP. 
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Figure 5: Process and Coordination between the Counterterrorism and Criminal Exploitation Unit and Student and Exchange 
Visitor Program (SEVP) and within SEVP Components 
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Further, ICE officials with CTCEU stated they have acquired specialized 
software tools to manage fraud tips and to conduct open-source and 
related research on certified schools suspected of acting fraudulently. To 
help identify and prioritize leads, ICE officials stated that they use a 
software tool to efficiently help review and prioritize tips received through 
ICE’s tip line, which gathers tips from the general public on suspicious or 
potential criminal activity. To aid investigations of schools, ICE explored 
the use of another specialized software to aid the review of online social 
media associated with schools or individuals, among other things. 


In addition, changes to SEVIS have aided ICE’s efforts to manage fraud 
risks in the program. In 2008, ICE initiated an effort to modernize SEVIS 
to address identified system vulnerabilities, such as the inability to 
capture detailed school data that would allow the detection of patterns 
and anomalies that could indicate fraud. Although SEVIS modernization is 
not yet complete, changes made in the system have helped to improve 
system usability and the ability to identify suspected fraud in the program, 
according to program officials. For example, system edit checks 
implemented in 2015 and 2016 to verify user-entered names and 
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ICE Does Not Have Some 
Components of a Fraud 
Risk Profile Needed to 
Fully Assess and Manage 
Fraud Risks 


addresses have enhanced data quality by helping to identify and prevent 
likely data-entry errors. SEVP officials also stated that improved data 
quality can help make it easier to distinguish potential fraud from 
unintentional data-entry errors. ICE officials we spoke to and related 
documentation we reviewed stated that SEVIS modernization efforts may 
include additional functionality, such as the ability to create person-centric 
records for each student. 


Although ICE has developed a Risk Assessment Model and Framework 
and taken other action to improve fraud risk management in SEVP, ICE 
has not fully developed and implemented a “fraud risk profile” that would 
help guide its efforts. According to our Fraud Risk Framework, an 
effective antifraud entity tailors the approach for carrying out fraud risk 
assessments to its programs.*® This approach allows an agency to, 
among other things, develop a fraud risk profile that 


e identifies the inherent fraud risks affecting the program, 


e assesses the likelihood and effect of each type of fraud risk that the 
agency has identified, 


e determines the agency’s tolerance for certain types or levels of fraud 
risks in the program, 


e examines the suitability of existing controls for each fraud risk, and 
e documents the program’s fraud risk profile. 


Effective managers of fraud risks use this profile to help decide how to 
allocate resources to respond to fraud risks. Further, Federal Internal 
Control Standards require managers to respond to identified risks. °9 
Appendix III provides additional information on the key elements in the 
fraud risk-assessment process including the development of a fraud risk 
profile. 


Our assessment of SEVP’s Risk Assessment Model and Framework 


found that while it describes the program’s approach for managing fraud 
risks, it does not include all of the key elements of a fraud risk profile: 


38GAO-15-593SP. 
39GAO-14-704G. 
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e First, SEVP’s Risk Assessment Model and Framework identifies three 
broad categories of inherent fraud risks that affect the program (those 
posed by schools, DSOs, and students), but does not include all risks 
that the program or its stakeholders have identified, such as the risk of 
third-party brokers. As noted previously, ICE agents and program 
officials identified brokers as a risk to the program because brokers 
have helped facilitate school and student fraud and misused or stolen 
student funds in the past. However, according to ICE officials with 
SEVP, SEVP’s Risk Assessment Model and Framework was not 
designed to define all of the risks posed to SEVP. 


e Second, while SEVP’s Risk Assessment Model and Framework 
assesses the potential effect of its risk posed by students, schools, 
and DSOs, it does not discuss the likelihood of the risk’s occurrence. 
For example, the Risk Assessment Model and Framework contains a 
narrative outlining the potential negative consequences of each of the 
three broad risk categories but does not address the likelihood of 
those risks occurring. According to SEVP officials, SEVP’s Risk 
Register helps identify and determine the likelihood of identified 
program risks. However, our review of the Risk Register found that it 
is used to track program-wide risks and does not identify or discuss 
specific fraud risks. Further, these officials stated that many of the 
components in a fraud risk profile are included in SEVP’s Risk 
Assessment Tool, but this tool was developed to prioritize the review 
of SEVP-certified schools that have potential compliance issues and 
was not designed to address all SEVP fraud risks such as the risks 
posed by students or brokers. Using information on the likelihood of 
risk occurrence can help managers decide how to allocate resources. 
For example, managers can use this information to make decisions to 
allocate resources to addressing fraud risks that are most likely to 
occur or have relatively high impact. 


e Third, SEVP’s Risk Assessment Model and Framework does not 
assess the agency’s tolerance for all fraud risks to the program. For 
example, while SEVP officials stated that students represent a 
significant risk to the program, they have not fully assessed the extent 
of risks associated with student fraud or the agencies’ tolerance for it. 
In October 2017, the SEVP Director stated that SEVP was just 
beginning to get a better understanding of student risks, but had not 
done an assessment of their likelihood and tolerance. However, SEVP 
officials acknowledged the importance of fully assessing student risks 
because of the challenges that can be associated with detecting, 
preventing, and responding to student fraud. 
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e Fourth, SEVP’s Risk Assessment Model and Framework does not 
examine the suitability of existing fraud controls or prioritize all 
residual risks that remain after inherent risks have been mitigated by 
existing control activities. We found that, while the Risk Assessment 
Model and Framework discusses different internal controls and tools 
used to prioritize and address risks in the school certification and 
recertification process, such as the Risk Assessment Tool, it does not 
explicitly identify any internal controls or tools used to prioritize or 
address student risks. In addition, the Risk Assessment Model and 
Framework does not identify and prioritize residual fraud risks that 
ICE has flagged as being vulnerabilities to the program. According to 
ICE agents in four field offices and officials in the Compliance Unit, 
limitations to SEVP’s ability to prevent some schools that present 
fraud risks from obtaining certification or continuing to participate in 
the program after fraud risks have been identified represent residual 
risks to the program. For example, officials in the Compliance Unit 
stated that certified schools that have been accredited through an 
accrediting body recognized by the Department of Education 
generally represent a lower fraud risk, but ICE has still experienced 
noncompliance and cases of fraud with these schools. At one point 
several fraud cases were tied to the same accrediting body. In 
another example of a potential residual risk to the program, ICE field 
agents stated that potentially fraudulent schools may continue to 
operate during criminal investigations, which can take several years to 
investigate and prosecute. During the investigation, schools may 
remain in operation and continue to enroll foreign students, provided 
their certification is not withdrawn through other administrative 
actions.*° As one example, ICE’s investigation into Prodee 
University—a case that involved hundreds of students—began in 
2011, but warrants were not issued until 2015. The school continued 
to operate and accept foreign students during the 4-year investigation, 
creating residual risk to the program during these years. 


According to SEVP’s Director, the program has not developed a fraud risk 
profile that fully addresses all identified risks because the program has 
not yet developed the maturity needed to manage its risks in this way, but 
she noted that doing so could be a good next step in the process. Without 
a fraud risk profile consistent with leading practices—which identifies all 


4°According to agency officials, the cases that take an excessive amount of time are 
typically those compliance cases that have an associated criminal investigation, which 
may take several years to complete, at which point prosecutors may decide in their 
discretion not to accept the case. Once that happens, in most cases it then becomes an 
administrative case handled by SEVP. 
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ICE Is Exploring the Use 
of Data Analytics to Aid 
Fraud Detection in SEVP 


fraud risks, discusses the likelihood of those risks, assesses the agency’s 
risk tolerance, and determines the suitability of related controls—ICE 
cannot ensure it has taken all necessary actions to address SEVP risks. 


ICE is exploring the use of better data analytics to help detect fraud in 
SEVP but has not yet employed techniques, like network analysis, to help 
detect and prevent fraud prior to certification. ICE officials with SEVP 
stated that they are exploring the use of additional data-analytics tools to 
help mitigate fraud in the program, including tools that can perform 
network analysis. However, these efforts are in their early stages and 
have been limited to conversations between program staff. While 
previously noted efforts to improve SEVIS may also include additional 
data analytics to mitigate fraud, these efforts have remained underway 
since 2008. Agency officials told us they recognize that better analytic 
tools can help them detect and prevent fraud in the certification process 
and are seeking additional resources to support this effort. According to 
agency documentation, SEVP awarded a contract in September 2018 to 
help establish a data-governance framework within SEVP. Among other 
things, the contract will examine the tools, skill sets, and number of 
people needed to support the data-related needs for SEVP, to include 
operational data and analytics. According to agency officials, SEVP plans 
to award a contract in the first quarter of fiscal year 2019 to provide better 
data-analytics support. 


Data-analytics approaches, such as network analysis, have the potential 
to enable ICE to identify high-risk schools prior to initial certification, thus 
allowing SEVP to apply increased oversight, as needed, during the 
adjudication process. Network analysis involves a quantitative approach 
for analyzing, summarizing, and graphically representing complex 
patterns of relationships among individuals or organizations. Such a 
technique is useful for identifying associations, such as between schools 
with current or past administrative and criminal concerns and those 
schools seeking certification. Information about the connections and 
relationships among schools—developed through network analysis—may 
then provide leads in reviews and investigations in the certification and 
recertification processes, which are important controls for preventing 
fraudulent schools from entering and remaining in the SEVP program. 
ICE field agents with two of five field offices we visited stated that it can 
be challenging to identify fraudulent schools as compared to legitimate 
ones during the initial certification of schools. For example, agents 
familiar with one investigation stated that after ICE began investigating a 
school for suspected fraud, the owner tried to establish another school, 
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which was only identified because of a lead provided through interviews 
conducted during the investigation. Further, because tools such as the 
Risk Assessment Tool use data analytics, but rely on information 
collected from current SEVP-certified schools, it can be difficult to identify 
schools with fraud concerns before they are certified to participate in the 
program. 


Using a network approach in our analysis of 2,439 SEVP-certified 
schools, we identified 11 connections that could raise fraud concerns. 
Specifically, we conducted a network analysis utilizing both public and 
proprietary information associated with certified schools as of September 
2017. We obtained basic information on these schools from ICE, such as 
school names and addresses. We also used public records associated 
with these schools related to businesses and people, such as past and 
current executives. Using this information and freely available public 
software, we identified relationships among certified schools that ICE had 
previously identified as having potential compliance or fraud concerns 
and other certified schools that did not have such concerns. For example, 
in 11 connections, we identified instances in which an executive appeared 
to have been employed by a school under active criminal investigation or 
administrative review who was either previously or later employed by a 
different school not under investigation or review. Moreover, for 2 of the 
11 connections, we found additional derogatory information associated 
with executives tied to SEVP-certified schools that could raise fraud 
concerns. For instance, one executive had employment terminated from a 
previous school and was under investigation for misappropriating school 
funds for personal use. While these connections do not prove fraud or 
noncompliance, they do provide information about potential risks, which 
can inform the prioritization of administrative and investigative resources 
during certification. 


ICE currently has limited ability to identify associations among schools 
with potential fraud concerns before they are certified to participate in the 
program. According to our Fraud Risk Framework, federal managers 
should design and implement specific control activities to prevent and 
detect fraud. These control activities can include data analytics, among 
other things, and should emphasize fraud prevention to the extent 
possible. A network approach provides the capability to better prevent 
and detect fraud by identifying potentially fraudulent schools before they 
are certified by SEVP and by detecting associations that pose a fraud risk 
among those already certified. 
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ICE Has Processes 
for School 
Certification and 
Ongoing Compliance 
Monitoring, but Long- 
Standing Delays in 
Recertifying Schools 
Pose Fraud Risks 


ICE Assesses Schools’ 
Initial and Continued 
Eligibility to Enroll Foreign 
Students through the 
Certification and 
Recertification Processes 
and Ongoing Compliance 
Monitoring 


ICE has processes in place for school certification, recertification, and 
ongoing compliance monitoring, and has taken steps to improve school 
certification controls since our 2012 report. We also found that ICE 
followed its established procedures and specifically identified GAO’s 
fraudulent petitions or otherwise took appropriate steps to prevent the 
petitions from moving forward in the process during our three 
independent covert tests of SEVP internal controls over the school 
certification process. However, the agency continues to face long- 
standing delays in conducting recertification reviews every 2 years to 
ensure that SEVP-certified schools continue to meet program 
requirements—one of its important fraud risk controls. As a result of these 
delays, ICE has a queue of recertification petitions awaiting adjudication, 
which creates additional fraud risks to the program if higher-risk schools 
continue to operate pending recertification. However, the agency has not 
assessed the magnitude of these risks. 


ICE’s certification and recertification processes are designed to assess 
schools’ initial and continued eligibility to enroll foreign students and, as 
previously discussed, once a school is certified, ICE is to monitor its 
continued program eligibility. SEVP-certified schools are to undergo 
recertification reviews every 2 years (see fig. 6). 
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Figure 6: Student and Exchange Visitor Program’s School Certification and Recertification Processes 
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Source: GAO analysis of ICE information. | GAO-19-297 


*Short of denial, SEVP may send a school a notice of rejection to inform it that prompt corrective 
action must be taken regarding its recertification petition prior to the certification expiration date to 
ensure continued access to SEVIS and acceptance of its petition for adjudication. 8 C.F.R. § 
214.3(h)(2)(i)(B). 
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Initial certification: As previously discussed, to be eligible for SEVP 
certification, a petitioning school must establish at the time of filing that it 
is a bona fide institution of learning or other recognized place of study that 
possesses the necessary facilities, personnel, and finances to conduct, 
and is in fact engaged in, instruction in recognized courses.*1 SEVP 
officials stated that they address potential fraud risks during the initial 
certification process by verifying the schools’ information and 
documentation through web-based research and a site visit to interview 
the school’s DSO and observe the school’s facilities. According to SEVP 
officials and guidance, as of October 2016, field representatives are 
responsible for conducting and documenting site visits for certifications. *7 
When conducting the visits, field representatives are to gather evidence 
on school eligibility for certification, review the facilities, and interview 
personnel nominated on the petition to become DSOs. They may also 
report back any anomalies or areas of concerns they may notice for 
further vetting by the compliance unit. SEVP received approximately 
2,000 certification petitions from fiscal years 2013 through 2017. See 
figure 7 for details on the number of approved and denied petitions during 
this period. 


Figure 7: Number of School Certification Petitions Approved and Denied per Year, 
Fiscal Years 2013 through 2017 
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Source: GAO analysis of Student and Exchange Visitor Program data. | GAO-19-297 


“18 C.F.R. § 214.3(a)(3). 


42SEVP previously used contractors to conduct initial site visits for certifications. 
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Note: Petitions approved or denied in one fiscal year may have been submitted in a prior fiscal year. 


ICE has implemented several controls to address fraud risks in the school 
certification process since our 2012 report on SEVP program risks, but 
long-standing delays in the recertification process create additional fraud 
risks. In particular, ICE strengthened its processes for verifying and 
monitoring schools’ accreditation and states’ licensing statuses. For 
example, since December 2012, SEVP adjudicators are to verify all “in 
lieu of’ letters during the school’s initial-certification and recertification 
processes.* In May 2015, SEVP developed a continuous process for 
verifying schools’ state licensing and accreditation status and updated its 
Adjudicator’s Manual with specific actions adjudicators must take to 
consistently verify evidence provided by schools, including “in lieu of” 
letters and states’ licensing documentation. In addition, SEVP took steps 
to ensure that all flight schools had the appropriate Federal Aviation 
Administration certification. ** 


Recertification: To be eligible for recertification, an SEVP-certified 
school must demonstrate at the time of filing that it remains eligible for 
certification and has complied during its previous period of certification or 
recertification with record-keeping, retention, reporting, and other program 
requirements.*° SEVP received approximately 14,000 recertification 
petitions from fiscal years 2013 through 2017. See figure 8 for details on 
the number of approved and denied petitions during this period. 


43An institution of higher education that is not a public educational institution or system, or 
accredited by a nationally recognized accrediting body, must provide evidence showing 
either that the school of higher learning confers recognized degrees upon its graduates, or 
its credits have been and are unconditionally accepted by at least three public or 
accredited institutions of higher education. 


“The Federal Aviation Administration monitors and controls flight training under 14 C.F.R. 
Parts 61, 141, and 142. The Federal Aviation Administration recognizes flight training in 
either Part 61, 141, or 142 as bona fide. To obtain or maintain SEVP certification, flight- 
training providers must be Federal Aviation Administration Part 141— or 142-certified. 


458 C.F.R. § 214.3(a)(3)(ii). 
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Figure 8: Number of Recertification Petitions Approved and Denied per Year, Fiscal 
Years 2013 through 2017 
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Source: GAO analysis of Student and Exchange Visitor Program data. | GAO-19-297 


Note: Approved and denied petitions are not necessarily a subset of the total number of petitions 
received within each year. 


The recertification process is an important fraud risk control, according to 
ICE officials, since they may determine that some certified schools are 
potentially noncompliant during the recertification process. For example, 
SEVP denied 105 recertification petitions from fiscal year 2013 through 
fiscal year 2017. On the basis of our review of recertification denial data, 
the majority of denials were due to the school’s abandoning its petition for 
recertification by not responding to SEVP’s request for further 
information.*° Appendix IV provides additional details on the withdrawal 
and denial of certification and recertification petitions as outlined in 
federal statute and regulation. For the remaining schools, SEVP issued a 


461f SEVP is unable to reaffirm the petitioning school’s continued eligibility for SEVP 
certification after concluding the recertification review, SEVP serves such schools with a 
notice of intent to deny the school’s petition for recertification, and the schools are allowed 
30 days to respond. If the school fails to respond to the notice of intent to deny, or does 
not address deficiencies in the petition, SEVP will subsequently deny the school’s petition, 
and issue a notice of denial. See 8 C.F.R. § 214.3(e)(5), (h)(2)(v). The notice of denial will 
address appeals options. Short of denial, a school may be sent a notice of rejection to 
inform it that prompt corrective action must be taken regarding its recertification petition 
prior to the certification expiration date to ensure continued access to SEVIS and 
acceptance of its petition for adjudication. Id. at §214.3(h)(2)(i)(B). 
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formal recertification denial notice for a variety of reasons, including those 
that highlight fraud risks in the program, such as 


e improper issuance of Forms I-20, including the issuance of forms to 
foreign students who will not be enrolled in or carry a full course of 
study; 


e DSO conduct did not comply with program regulations; 
e willful issuance by a DSO of a false statement; 


e failure to timely report school or course of study information, including 
material changes; and 


e failure to maintain the accreditation or licensing necessary to qualify 
graduates as represented in the school’s Form I-17.47 


Ongoing compliance monitoring: The Enhanced Border Security and 
Visa Entry Reform Act of 2002 provides that SEVP-certified schools are 
to comply with record-keeping and reporting requirements to enroll 
nonimmigrant students. Between schools’ initial certifications and their 
subsequent recertification reviews, ICE uses a variety of mechanisms to 
monitor ongoing compliance with program requirements and mitigate 
fraud risks. For example: 


e SEVP deployed its first group of field representatives in 2014. As of 
June 2018, ICE had 57 field representatives across 60 different 
geographic areas of responsibility nationwide. According to SEVP 
guidance, field representatives are to act as direct liaisons between 
SEVP and certified schools and are to try to meet with all certified 
schools in their territory at least once per year if the school has foreign 
students enrolled, or once every 2 years if no foreign students are 
enrolled. According to SEVP officials, the field representatives are to 
have a customer-service focus and assist DSOs in adhering to 
program requirements and, as a result, do not have law-enforcement 
or investigative responsibilities. However, if field representatives learn 
of potential fraud while visiting a school, they are to document and 
send this information to SEVP headquarters. All of the eight field 
representatives we interviewed reported that they primarily have a 
customer-service role but have also identified and reported suspected 
fraud to SEVP headquarters. For instance, one representative stated 
that she reported a language school because its stated level of 


47By regulation, an appeal of a notice of denial or withdrawal must be made within 15 days 
after service of the decision. 8 C.F.R. § 214.4(h). 
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student enrollment did not appear to correspond with the number of 
students in class during her visits to the school. 


e SEVP adjudicators are to verify and adjudicate changes that occur at 
an SEVP-certified school that require an update to the school’s Form 
I-17 petition information in SEVIS. These changes include the 
school’s name, location, or new areas of study offered, among 
others.*® According to Certification Unit officials, adjudicators review 
information from both SEVP’s risk tools and field-representative 
school-visit reports when adjudicating updates to identify any 
indications of noncompliance or fraud that need to be further reviewed 
and researched by the Compliance Unit. 


e Compliance Unit staff are to vet tips provided by external parties (such 
as DSOs from other schools) or internal stakeholders (such as field 
representatives or Certification Unit adjudicators) to determine 
whether they indicate the need to open an administrative or criminal 
investigation on the school. Compliance Unit staff may also identify 
schools for additional monitoring. The Compliance Unit is also 
responsible for extracting and analyzing data from SEVIS on an 
ongoing basis, including data related to certified schools and foreign 
students suspected of noncompliance and fraud, among other things. 
According to ICE officials, staff are responsible for researching 
schools with high-risk scores provided by the Risk Assessment Tool. 


e ICE may conduct an out-of-cycle review of a school at any time to 
help determine whether the school is complying with its reporting and 
record-keeping requirements and to ensure the school’s continued 
eligibility for SEVP certification.*? ICE may initiate an out-of-cycle 
review as a result of receiving information regarding potential 
noncompliance or fraud. The out-of-cycle review process may include 
a review of student records, a request for the submission of 
documentation to verify accreditation, a request for proof of state 
licensure, or a request for any other required evidence that 
establishes a school’s continued eligibility for SEVP certification. ICE 
officials stated that they may, pending the result of this review, issue a 
remedial action plan to the school describing the areas of 
noncompliance, such as correcting student records, that the school is 
required to address to maintain its program eligibility. If, upon 


48Under § 8 C.F.R. 214.3(g)(2) and (h), updates are to be made within 21 days of any 
changes. According to SEVP, the entire form must be kept up-to-date; however, certain 
updates require adjudication, consistent with ICE regulations. 


4°See 8 U.S.C. § 1762. 
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ICE Followed Its 
Procedures during Three 
GAO Covert Tests of ICE’s 
School Certification 
Controls 


completion of an out-of-cycle review, SEVP determines that a certified 
school has failed to sustain eligibility or has failed to comply with the 
record-keeping, retention, reporting, and other requirements, SEVP 
will institute withdrawal proceedings by serving the school a notice of 
intent to withdraw SEVP certification.°° At the conclusion of 
withdrawal proceedings, a school found to be ineligible for continued 
SEVP certification as a result of an out-of-cycle review will receive a 
notice of withdrawal (see app. IV for additional information on the 
withdrawal process).°*' 


ICE followed established procedures during our three covert tests of the 
internal controls over the SEVP school certification process by either 
successfully identifying GAO’s fraudulent petitions or by taking 
appropriate steps to prevent the petitions from moving forward in the 
process. Therefore, we did not identify any significant deficiencies during 
our testing of these controls. We submitted certification petitions and 
conducted other covert investigative work for three fictitious schools, all of 
which have differing certification requirements. Using these schools, GAO 
agents applied for SEVP certification. 


For one of the fictitious schools, we tested SEVP certification controls that 
require schools to submit complete documentation by submitting an 
application for the school that was missing several of the required 
documents.* Consistent with its procedures, ICE flagged our petition as 
incomplete and sent us a notification stating that our petition was 
canceled because we failed to submit all supporting evidence as outlined 
in the regulations. 


For our second school, we tested SEVP controls requiring schools to 
schedule and complete a site visit conducted by an SEVP field 


508 C.F.R. § 214.3(e)(4)(ii), (h)(3)(vi). Failure of a school to file an answer to a notice of 
intent to withdraw within 30 days will result in an unappealable withdrawal of the school’s 
certification. See id. § 214.3(e)(4)(ii). 


51See id. § 214.3(e)(7). 


52SEVP requires M schools to provide a completed Form 1-17 and documentation on 
Designated School Officials (DSO), payment, state recognition and exemption, evidence 
in lieu of accreditation, teacher qualifications, financials, facilities, attendance policy, 
grading policy, programs of study statement, and ownership. Our petition omitted the 
following documentation: evidence of state licensure or exemption, student letters of 
support, teacher qualifications, evidence in support of facilities, evidence of attendance 
policies, evidence of grading policies, evidence in support of the programs of study. 
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Long-Standing Delays in 
Recertifying Schools 
Create Additional Fraud 
Risks in SEVP 


representative, by submitting a completed petition, but avoiding the site 
visit and requesting that our paperwork move forward without it. SEVP’s 
field representative subsequently notified us that our petition would not 

move forward until a site visit was performed. 


For our third fictitious school, we submitted an application, and 
participated in a site visit with SEVP officials. We tested SEVP controls 
related to verifying application documentation, and whether SEVP site- 
visit officials followed established procedures for the site visit. The field 
representative toured the facilities and interviewed GAO agents posing as 
school officials. During its review of our petition, ICE took steps to verify 
our school’s information and discovered that documentation we submitted 
was fictitious. As a result, SEVP officials subsequently referred our school 
to ICE agents for further investigation, consistent with ICE policies and 
procedures. Upon learning that ICE followed its documented internal 
control processes, we concluded our covert testing. 


ICE faces long-standing challenges in conducting school recertification on 
a 2-year basis consistent with statute and regulation, which may allow 
potentially fraudulent schools to operate for a longer period without 
detection. The Enhanced Border Security and Visa Entry Reform Act of 
2002 states that DHS must conduct compliance reviews every 2 years, 
during which ICE reviews a school’s records to verify that it continues to 
comply with program-eligibility requirements.*°* ICE began the first 
recertification cycle in May 2010—8 years after the enactment of the 
statutory requirement for periodic review of SEVP-certified schools. As of 
March 2012—nearly 10 years after statutory enactment—ICE reported 
that it had recertified approximately 19 percent of certified schools. In 
October 2016, ICE reported that it had completed its first round of 
recertification (in other words, all existing certified schools had been 
recertified at least one time) and had used recertification to address a 
number of issues, including gathering missing data for some school 
records. 


ICE has continued to recertify schools. However, Certification Unit 
Officials told us that, while recertification should be conducted every 2 


53Each 2-year review is to determine whether the institutions remain in compliance with 
record-keeping and reporting requirements to receive F and M nonimmigrants under 8 
U.S.C. § 1372. See 8 U.S.C. § 1762. See also 8 C.F.R. § 214.3(e)(2); 73 Fed. Reg. 
55,683; 67 Fed. Reg. 60,107. 
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years, ICE has been unable to meet a 2-year time frame for all certified 
schools. ICE has been extending schools’ certification expiration dates 
since officials began recertifying schools in 2010, according to 
Certification Unit officials, to provide additional time for adjudicating 
recertification petitions.°* According to ICE regulations, schools should be 
notified 180 days before their certification expiration date and must file a 
completed petition for recertification by such date, which is 2 years from 
the date of their previous SEVP certification or the recertification 
expiration date.°° However, as described in figure 9, SEVP has been 
extending schools’ certification expiration dates by 180 days beyond the 
2-year mark as defined in ICE’s regulation. Under this process, schools 
must submit their complete petition and supporting documentation to 
SEVP within 180 days after the 2-year mark. 


Figure 9: Process for Recertification Notification and the Extension of Certification Expiration Dates 
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| The Student and Exchange Visitor Program (SEVP) sends all certified 
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Source: GAO analysis of SEVP information. | GAO-19-297 


‘4SEVP’s practice of extending certification expiration dates is confirmed in ICE’s July 17, 
2018, Notice of Proposed Rulemaking regarding SEVP fee adjustments, which states that 
“[eJach school is notified 2 years to the month following the date of its last recertification or 
certification about its need to file for recertification in order to maintain its certification. 
From that date, the school has 180 days to file for recertification. 8 CFR 214.3(h)(2)(i).” 
Adjusting Program Fees for the Student and Exchange Visitor Program, 83 Fed. Reg. 
33,762, 33,767 (July 17, 2018). 


558 C.F.R. § 214.3(e)(2), (h)(2). 
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Extending certification expiration dates increases the period between 
each recertification review, resulting in a decrease in the number of 
recertification reviews conducted in a given time frame, as shown in the 
hypothetical example of two schools in figure 10. 


Figure 10: Potential Effect of Extending Certification Expiration Dates on Recertification Reviews 
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Source: GAO analysis of SEVP information. | GAO-19-297 


Note: This figure demonstrates the effect of extending certification expiration dates using two 
hypothetical scenarios—one that follows the recertification time frames laid out in SEVP’s regulations 
and another that follows the extended process SEVP currently applies. The time frames represent the 
total allowable time under each scenario, as well as estimated review and adjudication time, and thus 
do not necessarily reflect actual recertification time frames for individual schools. 


For instance, if SEVP initially certified a school in January 2016, by 
providing an extension SEVP is setting the school’s certification expiration 
date to July 2018—2 years and 180 days after the initial certification—as 
opposed to 2 years after the initial certification, which would be consistent 
with ICE regulations. After receiving the school’s documentation, 
Certification Unit staff need time to review and adjudicate the petition. If 
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this school submits a complete petition to SEVP in June 2018—1 month 
before its revised expiration date—SEVP staff may and do take additional 
time, depending on the facts and circumstances of the specific petition, 
beyond the revised expiration date to adjudicate the petition. SEVP 
officials stated that, if necessary, they can further extend the certification 
expiration date to accommodate the time needed for their review. For 
instance, SEVP may not adjudicate this school’s petition until December 
2018. Once SEVP completes its adjudication in December 2018, the 
school’s new certification expiration date would be June 2021 (2 years 
and 180 days after December 2018). Thus, rather than potentially being 
able to complete two rounds of recertification during this 5-year period 
consistent with ICE regulation, SEVP would recertify the school only 
once. 


As we reported in 2012, according to SEVP officials, ICE delayed the 
recertification process until after SEVIS was deployed in 2003 and the 
program fee was increased in 2008 to support hiring additional staff.*° 
Further, with regard to resources, ICE officials stated that they are cross- 
training adjudicative staff across all of their program areas to help 
address the recertification workload, and creating regional adjudication 
teams with assigned territories similar to the field representatives’ 
territories to allow the adjudicators to work with the same schools 
throughout the school’s participation in the program. In addition, in 
February 2018, SEVP’s Director stated that ICE was expecting to hire 
additional adjudicators for a total of 10. In July 2018, ICE identified the 
need to increase initial certification fees and add a new recertification fee 
to, among other things, hire additional adjudicators to address longer 
recertification processing times. Specifically, ICE stated that, at present 
staffing levels, SEVP is able to process 1,939, or 44 percent, of the 
required annual projected 4,400 recertification cases.°’ 


ICE’s actions to allocate additional resources to the recertification process 
are a step in the right direction toward addressing its recertification 
delays. However, it is unclear whether these actions alone will be 
adequate to address the delays. As of June 2018, ICE officials told us 
that there were 3,281 recertification petitions that needed to be 
adjudicated. As previously discussed, recertification reviews are an 


56GAO-12-572. 


5’See Adjusting Program Fees for Student and Exchange Visitor Program, 83 Fed. Reg. 
33,762 (July 17, 2018) (to be codified at 8 C.F.R. pts. 103, 104). 
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ICE Does Not Assess 
Residual Risk Posed by 
Schools in Its 
Recertification Queue 


important fraud risk control because they are one of ICE’s primary means 
of reviewing each school’s data and identifying potential school 
noncompliance and fraud, especially since an out-of-cycle review may not 
be conducted for each school. As Federal Internal Control Standards 
state, management should: (1) establish and operate activities to monitor 
the internal control system and evaluate the results, and (2) identify, 
analyze, and respond to risks related to achieving the defined 
objectives.°® By not requiring schools to submit their petitions within the 
180-day period prior to the 2-year expiration date, as required by 
regulation, ICE has limited assurance it is leveraging the recertification 
process effectively to identify and respond to potential fraud risks to the 
program, including those risks associated with allowing a fraudulent 
school to operate for a longer period. ICE’s plan to increase the number 
of SEVP adjudicators may help it meet the 2-year recertification 
requirement, but without monitoring and evaluating the efficacy of these 
actions, ICE will not have reasonable assurance it can effectively manage 
the recertification process and associated fraud risks. 


As previously discussed, ICE’s queue of recertification petitions awaiting 
adjudication creates additional fraud risks to the program if higher-risk 
schools continue to operate pending recertification. However, ICE has not 
assessed the magnitude of such risks. 


As of June 26, 2018, ICE had 3,281 recertification petitions in a queue for 
review, according to SEVP officials, petitions that ICE adjudicates in the 
order in which they were filed. As discussed, ICE uses a variety of 
mechanisms to monitor schools’ ongoing compliance with program 
requirements and mitigate fraud risks. In addition, ICE assesses and 
considers schools’ risks during the adjudication process for recertification. 
Specifically, according to SEVP’s recertification standard operating 
procedures, case analysts in the Certification Unit are to review the 
recertification packages once submitted to determine whether they are 
complete and prepare them for adjudication. Further, SEVP officials 
stated that the Certification Unit staff use an assessment of the school’s 
risk to help prioritize further analysis and review efforts. When 
adjudicating recertification petitions, adjudicators are to confirm that they 
have assessed the school’s risk and whether any identified risks have 
previously led to any further action, according to Certification Unit 


58GAO-14-704G. 
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Officials. If case analysts determine that compliance issues are present 
(e.g., the school has closed or the school has made updates to the Form 
I-17 that are awaiting adjudication), *° they are to notify their supervisors. 
For higher-risk schools, Certification Unit officials stated that adjudicators 
may request more detailed evidence from schools as part of 
recertification, consistent with their standard operating procedures, than 
they would for lower-risk schools to help make more efficient use of the 
resources in this unit. 


These processes have helped SEVP consider and address potential risks 
during the recertification process. However, SEVP has not determined 
risks posed by schools in its recertification queue and, according to 
Certification Unit officials, does not prioritize the review of schools’ 
recertification petitions in its queue based on risk. As previously noted, 
ICE is required to conduct periodic reviews every 2 years to determine 
SEVP-certified schools’ continued program eligibility and compliance. °° 
The statute governing recertification does not, by its terms, preclude ICE 
from considering a school’s relative risk as part of the compliance review 
process. However, SEVP’s Director and Certification Unit officials stated 
that a recertification process that prioritizes reviews based on school risk 
would not be particularly helpful or add value in addressing school 
compliance concerns because the officials already have a number of 
mechanisms they can use, as previously discussed, to address potential 
noncompliance, including conducting out-of-cycle reviews of high-risk 
schools. 


Although ICE considers schools’ risk-related information during the 
adjudication process and may identify noncompliant or potentially 
fraudulent schools through ongoing monitoring activities, ICE has not 
determined the extent to which there are residual fraud risks posed by 
schools in the recertification queue that ICE has identified as higher-risk 
than other schools awaiting recertification. According to GAO’s Fraud 
Risk Framework, managers should rank residual fraud risks in order of 
priority, using the likelihood and impact analysis, as well as risk tolerance, 
to help decide how to allocate resources to respond to residual fraud 
risks, all of which is documented in a fraud risk profile. As previously 


5°An SEVP-certified school may have only one petition at a time due to SEVIS 
functionality, according to SEVP officials. Thus, officials stated that a school cannot file an 
additional petition (e.g., for recertification) until the previous petition finishes adjudication 
and has a decision in the system. 


S°See 8 U.S.C. § 1762. 
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ICE Has Implemented 
Controls That Mitigate 
Fraud Risks Related 
to the Eligibility, 
Suitability, and 
Training of DSOs, but 
Weaknesses Exist 


ICE Does Not Routinely 
Verify DSO-Submitted 
Eligibility Information in 
Support of Their 
Immigration or Citizenship 
Status 


discussed, a fraud risk profile (1) identifies the inherent fraud risks 
affecting the program, (2) assesses the likelihood and effect of each type 
of fraud risk that it has identified, (3) determines the agency’s tolerance 
for certain types or levels of fraud risks in the program, and (4) examines 
the suitability of existing controls for each fraud risk. Given SEVP’s long- 
standing delays in recertifying schools, without an assessment of residual 
risks posed by the recertification queue—as part of its fraud risk profile, 
as previously noted—ICE cannot ensure that it is effectively addressing 
the risks posed by higher-risk schools awaiting recertification, a situation 
that does not help further strengthen ICE’s fraud risk-management efforts 
in SEVP. 


ICE has identified fraud risks related to DSOs and implemented controls 
to mitigate these risks, but weaknesses exist in four key areas: (1) 
verification of information provided by DSOs in support of their eligibility, 
(2) background checks, (3) mandatory compliance training, and (4) fraud- 
risk training. Prior to approval of schools’ nomination of individuals to 
serve as DSOs, these nominees must meet eligibility requirements and 
pass a criminal-background check, but weaknesses exist in both of these 
controls. In addition, once ICE approves prospective DSOs, it has 
controls for oversight and training; however, this training is not mandatory 
and does not address fraud risks. 


ICE has eligibility requirements for school employees seeking to serve as 
DSOs at SEVP-certified schools, as discussed earlier, but does not 
routinely verify DSO-submitted eligibility information in support of their 
immigration or citizenship status. According to ICE regulations, to be 
eligible to participate as a DSO, an individual must be a regularly 
employed member of the school administration whose office is located at 
the school and must meet two primary eligibility criteria.*' First, a DSO’s 
compensation may not include commissions for recruitment of foreign 
students. To verify that requirement, a field representative is to interview 
a school’s principal DSO during an initial certification site visit, and ask 


581A Designated School Official (DSO) is a U.S. citizen or lawful permanent resident who is 
a regularly employed member of the school administration, named by the president, 
owner, or head of the school, whose office is located at the school, and whose 
compensation does not come from commissions for recruitment of foreign students. DSOs 
are to certify their familiarity, and intent to comply, with the regulations governing foreign 
students and school certification (8 C.F.R. § 214.3(I)). At the time a new DSO is added, 
the DSO must make the same certification. 
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whether any prospective DSOs receive compensation from commissions 


for recruitment of foreign students. In addition, a field representative is to 
review the school’s website for recruitment-related activities and evaluate 
the DSO’s job title and position description, according to ICE officials. 


Second, DSOs must be U.S. citizens or lawful permanent residents, but 
the Certification Unit does not routinely verify the evidence provided to 
meet this eligibility requirement. Specifically, DSOs are to submit 
documentation during the school’s certification or recertification process— 
such as a passport, birth certificate, Permanent Resident Card or Alien 
Registration Receipt Card, or copy of naturalization/citizenship 
certificate—as evidence of their U.S. citizenship or lawful permanent 
resident status.® The Certification Unit is to review this documentation to 
verify that the biographic details match the information provided on the 
school’s Form I-17. According to ICE officials, if the Certification Unit 
suspects that a prospective DSO’s documentation may not be valid, it will 
send the information to the Compliance Unit for additional review.“ 


However, neither the Certification Unit nor the Compliance Unit routinely 
verify the information reported by DSOs in support of their immigration or 
citizenship status because they do not have access to the type of 
information needed to independently verify this information for all 
prospective DSOs, according to ICE officials. Certification Unit officials 
told us that verifying information on naturalized U.S. citizens and lawful 
permanent residents would be beneficial. They said that they have 
previously asked for access to information, such as other DHS databases 
that contain information on naturalized U.S. citizens or lawful permanent 
residents, to strengthen their process for determining the eligibility of 


628 C.F.R. § 214.3(I)(1)(i). 


68Naturalization is the process by which a lawful permanent resident obtains U.S. 
citizenship. A person may be eligible for naturalization after residing continuously in the 
United States as a lawful permanent resident for at least 5 years (3 years for a U.S. 
citizen’s spouse), and meeting other criteria. Separate requirements apply to members of 
the military and their families. See 8 U.S.C. § 1427. A citizen parent may apply for 
naturalization on behalf of a child born outside the United States who has not acquired 
citizenship automatically. See 8 U.S.C. § 1433. 


®4For this additional review, the Compliance Unit may coordinate with other ICE units, 


including the Identity and Benefit Fraud Unit, for expertise related to document fraud, or 
CTCEU. 
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ICE Plans for More- 
Comprehensive Vetting of 
Prospective DSOs’ 
Suitability for the Position 
Remain Incomplete 


prospective DSOs.*°° However, they have yet to receive access to this 
information. In addition, verifying eligibility information for U.S.-born 
citizens would also be valuable, but is more difficult than for naturalized 
U.S. citizens or lawful permanent residents, according to ICE officials. 
This is because ICE does not collect DSOs’ Social Security numbers— 
key information necessary to verify U.S. citizenship—in part because 
SEVIS does not have the necessary security features needed to collect 
and house those data, and adding those features would be costly. In June 
2018, ICE management officials stated that they were reviewing 
databases that may be useful to verify DSOs’ self-reported eligibility 
information but did not provide any additional support or documentation of 
those plans or a time frame for completing this review. 


As outlined in our Fraud Risk Framework, as part of an effective antifraud 
strategy, managers should take steps to verify reported information, 
particularly self-reported data. Specifically, managers can benefit from 
conducting data matching to verify key information, including self-reported 
data and information necessary to determine eligibility, using government 
or third-party sources to verify data electronically. Until ICE routinely 
verifies the eligibility information submitted by prospective DSOs in 
support of their immigration or citizenship status, particularly for 
naturalized U.S. citizens and lawful permanent residents, ICE will not be 
able to ensure that it is preventing ineligible individuals, including those 
who represent a fraud risk, from becoming DSOs and providing them with 
access to SEVIS to maintain student records. 


ICE has taken some initial steps to strengthen the process for vetting 
prospective DSOs but has not implemented comprehensive background 
checks on DSO nominees prior to approving them to carry out the DSOs’ 
reporting, record-keeping, and other functions. ICE officials told us that 
they have been working since December 2016 to develop a plan to 
conduct comprehensive background checks on prospective DSOs to 
address past concerns about DSO vetting. Specifically, in 2011, ICE 
expressed concerns that DSOs, who were not required to undergo 


®5According to ICE officials, applicable DHS databases may include the Computer Linked 
Application Information Management System and the Central Index System. These 
databases maintain information on immigration applications and petitions. In addition, the 
U.S. Citizenship and Immigration Services’ Systematic Alien Verification for Entitlements 
Program provides immigration status verification to government agencies, including 
agencies that need to check an individual’s immigration status as part of a background 
investigation. 
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background checks, were responsible for maintaining updated information 


of foreign students in SEVIS. 


According to ICE officials, they have taken initial steps to address these 
concerns by implementing criminal-background checks on prospective 
DSOs. Specifically, in May 2017, ICE started conducting background 
checks on all school employees nominated to be DSOs at the time of 
petitioning for initial SEVP certification or whenever a school requests to 
add a new DSO. For these types of checks, ICE officials within CTCEU 
are to review the prospective DSO’s biographic information from both the 
Form I-17 and the proof of U.S. citizenship or immigration status 
documentation received by the school. After ICE officials in CTCEU 
complete this check, they are to forward the findings to SEVP for review. 
If SEVP determines that a prospective DSO is unsuitable for participation 
in the program, ICE officials in SEVP are to send a notice of rejection to 
the nominating school.®° From April 2017 to March 2018, ICE screened 
approximately 4,750 prospective DSOs and identified 68 individuals with 
a criminal history. ICE rejected the nomination of 15 of these prospective 
DSOs, because, for example, they had criminal histories that included 
instances of identity theft, fraud in obtaining U.S. citizenship, and 
conspiracy, among other crimes. ICE officials stated that certain crimes 
will not necessarily disqualify a candidate, such as misdemeanors, traffic- 
related infractions, or other lesser crimes. 


As of June 2018, ICE officials told us that they are developing a more- 
comprehensive background-check process to screen prospective DSOs 
against additional government data sources. Specifically, ICE officials told 
us that they are seeking to partner with DHS’s Transportation Security 
Administration (TSA) to collect biometric information (e.g., fingerprints) on 
prospective DSOs at TSA’s enrollment provider locations nationwide 
during the school certification process.®’ ICE officials stated that they 
intend to provide the biometric information they collect through TSA’s 
enrollment provider to ICE’s Office of Professional Responsibility (OPR), 


668 C.F.R. § 214.3(I)(2) provides that ICE may, in its discretion, reject a DSO’s nomination 
to participate in the program or withdraw a DSO. There are several issues that may lead 
ICE to exercise this discretion. For example, SEVP may reject a DSO nominee whose 
background investigation uncovers derogatory information such as criminal charges or 
convictions. 


5’Enrollment services include the capture of biometric data (photographs/fingerprints), 


biographic data, and identity documentation required to enroll and register for certain TSA 
security threat assessment programs such as TSA PreCheck. 
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and OPR officials will review such information to determine DSOs’ 
suitability. According to agency documentation, ICE’s OPR would vet 
such information against data sources to screen these individuals for prior 
criminal histories such as sexual misconduct, terrorist activities, and 
immigration violations. According to ICE officials, they also intend to use 
this process to periodically review the suitability of incumbent DSOs. 


While ICE officials have told us they intend to expand the screening of 
prospective DSOs, ICE does not have a documented implementation plan 
that outlines how the project will be executed. The Project Management 
Institute’s A Guide to the Project Management Body of Knowledge 
(PMBOK® Guide) identifies standards related to project-management 
processes, including the need to have documented implementation plans 
describing how the project will be executed, monitored, and controlled, as 
well as requirements and techniques for communication and establishing 
agreements among stakeholders.®° In addition, GAO’s Schedule 
Assessment Guide identifies best practices associated with developing 
and maintaining a reliable, high-quality schedule.® ICE provided us with a 
draft of its revised background-check policy, talking points on its plans for 
these checks, and draft requirements it shared with TSA in December 
2016. However, these documents do not provide a detailed project- 
implementation plan to guide ICE’s effort. As of June 2018, ICE and TSA 
officials have met twice in the last 2 years, and ICE officials do not have 
any documents or other written details on their planned coordination with 
TSA. SEVP’s Director acknowledged that SEVP will need to develop a 
project plan to help guide its coordination with TSA and ICE’s OPR. 
Without a documented implementation plan for this effort that outlines 
how the project will be executed, monitored, and controlled, ICE does not 
have reasonable assurance that it will be able to implement a more- 
comprehensive DSO background-check process. 


68Project Management Institute, A Guide to the Project Management Body of Knowledge. 


88GAO-16-89G. 
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ICE Has Mechanisms to 
Monitor and Support 
DSOs but Does Not Have 
Mandatory Training for 
Them 


ICE has established mechanisms for monitoring SEVIS usage by 
approved DSOs and providing support to DSOs to help them ensure their 
schools comply with SEVP requirements but does not mandate training 
for DSOs. Once DSOs are approved by SEVP, they are authorized to 
make changes to student records in SEVIS and to create Forms I-20, 
which enable students to apply for nonimmigrant student status.’”° To 
detect noncompliance and fraud that may be committed by DSOs during 
this process, ICE has established mechanisms to monitor information 
entered and identify data for computers used by DSOs through SEVIS 
compliance checks, among other things. For example, according to 
agency Officials, |CE monitors DSO actions in SEVIS to help prevent 
noncompliance and fraud. 


In addition to monitoring DSOs’ use of SEVIS, ICE provides support and 
training to DSOs to help ensure they can effectively update and maintain 
student records in SEVIS and provide recommendations to students 
regarding the maintenance of their status, according to our review of ICE 
documentation and interviews with ICE and school officials. According to 
program rules, DSOs are responsible for understanding SEVP regulations 
related to the requirements for foreign students’ admission, maintenance 
of status, and change of status and requirements for school approval. To 
assist them, ICE officials and DSOs that we interviewed told us that 
SEVP uses its field representatives to provide DSOs with a point of 
contact for questions related to the program. According to SEVP’s internal 
guidance, field representatives are expected to visit the schools within 
their areas of responsibility at least once a year to provide in-person 
guidance and training to DSOs. DSOs at 15 of the 17 schools we visited 
stated that the field representatives were helpful, including with providing 
guidance on how to comply with SEVP rules and regulations. 


In addition, SEVP internal guidance encourages DSOs to take its web- 
based training course on the responsibilities and obligations for both 
DSOs and foreign students in SEVIS. However, this course is voluntary.”' 
According to ICE officials and field representatives, the extent to which 


Specifically, the Form I-20 Certificate of Eligibility for Nonimmigrant Student Status is to 
be completed and approved before students apply for F and M nonimmigrant student 
status from abroad or within the United States, through Department of State visa or U.S. 
Citizenship and Immigration Services change of status processes, respectively. 


“ICE also provides online information materials—such as topic-specific webinars, a blog, 
and conference presentations—to DSOs, among other resources. 
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DSOs take the voluntary training varies—some DSOs receive additional 


training beyond the voluntary SEVP training, but other DSOs do not 
complete any training. ICE officials noted that the voluntary online training 
may be perceived as cumbersome and that, since it is not required, many 
DSOs instead reach out to field representatives or call the SEVP 
Response Center to get answers to questions that are covered by 
existing training materials. ICE officials also stated that they do not know 
the extent to which DSOs have completed the online training because 
they do not track this information. Further, the officials acknowledged that 
since training is voluntary, some DSOs may not complete it before 
assuming their responsibilities and gaining access to SEVIS. 


ICE officials we interviewed told us they encounter problems with DSOs 
complying with record-keeping requirements; however, they believe most 
of these issues are a result of DSOs not understanding program rules or 
their own responsibilities within the program. According to agency 
documentation, in 2014 SEVP found that some DSOs were inconsistently 
reporting school information in several SEVIS data fields.’ In addition, 
SEVP’s Risk Assessment Tool includes a number of high-risk indicators 
that may stem from DSO record-keeping errors within SEVIS, including 
students listed as enrolled in an academic program not available at that 
school (e.g., doctoral students at schools without doctorate degrees 
available) and students listed as active who have long exceeded their 
program’s end date or authorized employment’s end date. Errors such as 
these make it difficult for ICE officials to know whether the information in 
SEVIS is inaccurate due to unintentional mistakes by the DSO or whether 
the school or its employees may be engaged in potential fraud. For 
additional examples of potential noncompliance or fraud, see the box 
below. 


”2According to officials, SEVP has made some updates to SEVIS, as discussed earlier, in 
an effort to improve data quality, including developing data-entry rules that prevent DSOs 
from entering certain incorrect information. 
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Potential Designated School Official Noncompliance or Fraud 


Student and Exchange Visitor Program officials cited the following examples of potential 
noncompliance or fraud that they have encountered, among others: 


e the reported foreign-student enrollment listed in the Student and Exchange Visitor Information 
System (SEVIS) does not seem to correspond with the number of students attending class or 
the size of the school’s physical space, 


e all enrolled foreign students listed in SEVIS are living at the same address, and 


e students repeatedly transfer to several different schools. 


Source: GAO. | GAO-19-297 


Field representatives at one location we visited noted that DSOs with 
multiple job responsibilities may not have time to keep up with SEVP 
rules and policy updates. Similarly, DSOs at 7 of the 17 schools we spoke 
with mentioned that they have multiple job responsibilities beyond their 
DSO duties. In addition, SEVP officials indicated that DSOs have a high 
rate of turnover, especially at small schools, and may lack the expertise to 
effectively follow program requirements. 


SEVP officials acknowledged that mandatory training could help reduce 
the number of unintentional violations by DSOs who may not adequately 
understand the program’s regulations, thus allowing SEVP staff to focus 
their monitoring efforts on schools and individuals who may be engaged 
in intentional noncompliance and fraud. In June 2018, ICE officials told us 
that they recently received internal agreement to require all new DSOs to 
complete training prior to gaining full access to SEVIS once the officials 
release a new version of their DSO training program. However, SEVP 
officials could not provide documentation on their plans, including time 
frames for completing the revised DSO-training program, whether to 
require DSO training, or how they will track DSO compliance. Federal 
Internal Control Standards calls for agencies to demonstrate a 
commitment to competence, including recruiting, developing, and 
retaining competent individuals. Further, it recommends that agencies 
establish expectations of competence for key roles, including possessing 
the necessary knowledge, skills, and abilities, and training individuals 
appropriately. ’? Without mandatory training and a process to verify that 
training is completed, SEVP does not have reasonable assurance that 
DSOs are familiar with, and understand, their roles and responsibilities as 
outlined in program regulation. 


73GAO0-14-704G. 
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Most DSOs Do Not 
Receive Fraud Training 


SEVP’s voluntary DSO training emphasizes student and school 
compliance with program rules and the DSOs’ responsibilities to enter 
and maintain complete and accurate information in SEVIS in a timely 
manner but does not address fraud risks to the program, including 
previously identified fraud schemes or trends. According to ICE officials, 
some DSOs may receive fraud-specific training from ICE agents through 
the Project Campus Sentinel initiative; however, these visits are limited to 
a small portion of certified schools each year.”* During a Project Campus 
Sentinel visit, |CE guidance states that an ICE agent will meet with DSOs 
and provide information on how to detect potential fraud, including 
student visa exploitation and national security vulnerabilities. In addition, 
ICE guidance encourages ICE agents to remind DSOs to contact them 
when they encounter these instances. In fiscal year 2017, ICE officials 
reported that ICE agents visited 400 of the more than 18,000 SEVP- 
certified school campuses in existence at that time.’° According to ICE 
officials, the agency can only conduct a limited number of Project 
Campus Sentinel visits to schools each year due to competing 
investigative priorities. 


The DSOs we spoke with varied in their understanding of the role they 
should play in identifying and reporting fraud to SEVP. Specifically, DSOs 
at 8 of 17 schools told us they did not receive training on SEVP-related 
fraud risks or could not identify SEVP-provided, fraud-specific training. 
For example, DSOs at one school told us that there is confusion among 
DSOs about their role to prevent and report fraud and that this issue has 
been discussed at past training events and conferences. Specifically, they 
stated that there is some confusion over the difference between fraud and 
noncompliance. According to these DSOs, they are responsible for 
addressing issues of noncompliance, but they do not actively look for 
SEVP-related fraud. A DSO from another school told us she interprets the 
DSO role as providing program oversight, including oversight related to 
fraud, and that she previously reported an instance of potential student 
fraud to ICE when she encountered suspicious immigration paperwork. In 
addition, DSOs at another school told us that they were not aware of any 


74In 2011, ICE developed Project Campus Sentinel as an outreach initiative directed 
toward SEVP-certified schools to prevent the criminal exploitation of SEVP. 


75s of March 2018, there were 8,744 certified SEVP schools; however, some schools had 
multiple campuses. 
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Conclusions 


training related to fraud risks within SEVP but noted that guidance about 
fraud trends or potential red-flag indicators could be useful. 


The Fraud Risk Framework identifies training as one way of 
demonstrating an agency’s commitment to combating fraud. Training and 
education intended to increase fraud awareness among stakeholders, 
managers, and employees serves as a preventive measure to help create 
a culture of integrity and compliance within the agency. Specifically, the 
Fraud Risk Framework discusses leading practices for training and 
education, including communicating responsibilities for implementing 
fraud controls and details on how and where to report fraud. In addition, 
increasing awareness of fraud schemes, including red flags and risk 
indicators, through training and education can serve a preventive purpose 
by helping create a culture of integrity and compliance within the program 
and can enable managers, employees, and stakeholders with 
responsibility for implementing aspects of the program to better detect 
potential fraud. According to ICE officials, DSOs can serve as the front 
line against SEVP-related fraud, and they provide a significant portion, if 
not the majority, of fraud-related tips. 


In June 2018, ICE officials told us that, in response to discussions that we 
had during our review, they plan to incorporate fraud training into the 
revised DSO training. However, because ICE officials just recently made 
that decision, they had not yet developed documented plans for this 
training or timelines for when it would be completed. While agreeing to 
incorporate fraud training into the revised DSO training is a good first 
step, the development and execution of those plans will be needed to 
strengthen fraud controls. Until ICE develops and implements a plan for 
fraud-specific DSO training, ICE will not have reasonable assurance that 
this training will be delivered and DSOs will have the information they 
need to address fraud within the program. 


Through SEVP, ICE oversees over 1.2 million foreign students at nearly 
9,000 SEVP-certified schools across more than 18,000 campuses. Past 
instances of fraud and noncompliance in the program have resulted in 
ICE taking some steps to address fraud risks in the program, such as 
developing a Risk Assessment Model and Framework. However, ICE 
does not have a fraud risk profile that identifies all of SEVP’s fraud risks, 
discusses the likelihood of those risks, assesses related controls, and 
identifies the agency’s tolerance for risk. Such a fraud risk profile would 
help ICE more effectively assess whether additional internal controls or 
changes to policies or regulations are needed. Moreover, ICE has not yet 
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Recommendations for 
Executive Action 


fully employed the use of data analytics, such as network analysis, to help 
it identify potentially fraudulent schools before they become certified to 
enroll foreign students and help it better use its administrative and 
investigative resources. 


ICE has also made improvements to its processes for certifying and 
recertifying SEVP schools and monitoring DSOs—all of which can help 
reduce the risk of fraud in the program. However, ICE continues to delay 
the recertification process by initiating the school recertification reviews 
after the 2-year certification expiration date, which is not consistent with 
ICE regulations. Further, ICE has not included an assessment of residual 
risks posed by the current recertification queue—as a part of the fraud 
risk profile previously noted—and as a result does not have a full 
understanding of the risks associated with schools awaiting recertification. 
Although DSOs play an important role in helping ICE oversee students in 
the program, ICE has recognized they can pose fraud risks to the 
program. However, ICE does not routinely verify DSO-submitted eligibility 
information and DSO suitability for participation in SEVP, and therefore 
does not have reasonable assurance that only eligible and suitable DSOs 
are participating in the program. Finally, ICE has not developed or 
implemented mandatory and fraud-specific training to improve DSOs’ 
compliance with program requirements and aid its efforts to detect fraud 
in the program. 


We are making the following seven recommendations to ICE: 
e The Director of ICE should develop a fraud risk profile that aligns with 
leading practices and 
e identifies inherent fraud risks affecting the program, 
e assesses the likelihood and impact of inherent fraud risks, 
e determines fraud risk tolerance, and 


e examines the suitability of existing fraud controls and prioritizes 
residual fraud risks, including residual risks posed by the 
recertification queue. (Recommendation 1) 


e The Director of ICE should build on existing efforts to use data 
analytics by employing techniques, such as network analysis, to 
identify potential fraud indicators in schools petitioning for certification. 
(Recommendation 2) 
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e As ICE works to complete its efforts to hire additional SEVP 
adjudicators, the Director of ICE should begin notifying certified 
schools 180 days prior to, and requiring submission of complete 
recertification petitions by, the 2-year certification expiration date, 
consistent with regulation, and evaluate whether additional resources 
are needed. (Recommendation 3) 


e The Director of ICE should, as practicable, verify the eligibility 
information provided to establish the immigration or citizenship status 
of lawful permanent residents and naturalized U.S. citizens, as well as 
U.S.-born citizens, who have been nominated or renominated to serve 
as DSOs. (Recommendation 4) 


e The Director of ICE should develop an implementation plan for the 
project aimed at strengthening background checks for DSOs; that 
plan should outline how the project will be executed, monitored, and 
controlled. (Recommendation 5) 


e The Director of ICE should implement mandatory DSO training and 
verify that the training is completed. (Recommendation 6) 


e The Director of ICE should complete the development and 
implementation of its plans for mandatory fraud-specific training for 
DSOs. (Recommendation 7) 


We provided a draft of this report to DHS for its review and comment. In 
its written comments, reproduced in appendix V, DHS concurred with our 
recommendations and described specific steps it plans to take in 
response to all seven of our recommendations. DHS also provided 
technical comments, which we incorporated as appropriate. 
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We are sending copies of this report to the appropriate congressional 
committees and the Secretary of Homeland Security. In addition, the 
report is available at no charge on the GAO website at 
http://www.gao.gov. 


If you or your staff have any questions about this report, please contact 
Rebecca Shea at (202) 512-6722 or shear@gao.gov or Rebecca 
Gambler at (202) 512-8777 or gamblerr@gao.gov. Contact points for our 
Offices of Congressional Relations and Public Affairs may be found on 


the last page of this report. GAO staff who made key contributions to this 
report are listed in appendix VI. 


Rebecca Sea 


Rebecca Shea 
Director, Forensic Audits and Investigative Service 


theca “arndla 


Rebecca Gambler 
Director, Homeland Security and Justice 
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Ranking Member 

Subcommittee on Emergency Preparedness, Response, and Recovery 
Committee on Homeland Security 

House of Representatives 


The Honorable Charles E. Grassley 
United States Senate 


The Honorable Martha McSally 
United States Senate 


The Honorable Michael T. McCaul 
House of Representatives 
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2 Recommendations 


on the Student and Exchange Visitor 
Program, and the Agency's Response 


Table 1 contains information on the eight recommendations that we made 
to U.S. Immigration and Customs Enforcement (ICE) in our 2012 report, ' 
and ICE’s actions to address them. We closed each of these 
recommendations as implemented. 


Table 1: GAO’s 2012 Recommendations to U.S. Immigration and Customs Enforcement (ICE) on the Student and Exchange 


Visitor Program (SEVP), and the Agency’s Response 


Recommendation 


Agency action 


Develop and implement a process to identify and assess risks in 
SEVP, including (1) evaluating prior and suspected cases of 
school noncompliance and fraud to identify potential trends, and 
(2) obtaining and assessing information from the Counterterrorism 
and Criminal Exploitation Unit (CTCEU) and ICE’s field-office 
investigative and outreach efforts. 


In June 2012, SEVP issued a report outlining the program’s risk- 
management methodology and process. The report outlined 
steps taken to identify and assess risks, including evaluating prior 
cases of noncompliance and gathering information from criminal 
investigators. 


Once a risk-assessment process is in place, conduct an analysis 
of how to allocate SEVP’s resources based on risk and use the 
results of that analysis in making resource-allocation decisions. 


In June 2012, SEVP issued a report outlining the program’s risk- 
management methodology and process. Specifically, in the 
report, SEVP outlined the program’s efforts to develop a 
framework, which uses a risk-based approach to inform the 
identification, prioritization, and management of noncompliant and 
potentially noncompliant SEVP-certified schools. 


Consistently implement procedures for ensuring schools’ eligibility, 
including consistently verifying “in lieu of” letters. 


In May 2015, SEVP updated its Adjudicator’s Manual with specific 
actions adjudicators must take to consistently verify evidence 
provided by schools, including “in lieu of? letters. 


Establish a process to identify and address all missing school case 
files, including determining the magnitude of the problem; 
obtaining required documentation for schools whose case files are 
missing evidence, as appropriate; and taking necessary 
compliance actions. 


In July 2013, SEVP completed its assessment of all SEVP- 
certified schools that were missing case files. In October 2016, 
SEVP officials reported and provided supporting documentation 
demonstrating that they completed the first round of recertification 
on all schools. 


Develop and implement a process to monitor state licensing and 
accreditation status of all SEVP-certified schools. 


SEVP developed a continuous process for verifying schools’ state 
licensing and accreditation status that was finalized in September 
2014 and updated in May 2015. In October 2016, SEVP officials 
reported and provided supporting documentation demonstrating 
that they completed the first round of recertification on all schools. 


Establish target time frames for notifying SEVP-certified flight 
schools that lack required Federal Aviation Administration 
certification that they must reobtain required certification. 


In December 2012, SEVP clarified its policy on flight-training 
providers to require that flight schools have Federal Aviation 
Administration certification to be eligible to enroll foreign students. 


Revise the standard operating procedure that governs 
coordination among SEVP, CTCEU, and ICE field offices to 
specify what information to share among stakeholders during 
criminal investigations. 


In January 2013, SEVP and CTCEU approved agency changes 
to the standard operating procedures in accordance with our 
recommendation. These changes, among other things, required 
additional checks of schools during criminal investigations to aid 
the sharing of information. 


‘GAO, Student and Exchange Visitor Program: DHS Needs to Assess Risks and 
Strengthen Oversight Functions, GAO-12-572 (Washington, D.C.: June 18, 2012). 
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Recommendation Agency action 


Establish criteria for referring cases of a potentially criminal nature In January 2013, SEVP and CTCEU approved the agency’s 

from SEVP to CTCEU. changes to the standard operating procedures in accordance with 
our recommendation. Specifically, the revised procedures require 
that SEVP share all administrative or noncompliance cases, 
including those that may be potentially criminal, with CTCEU ona 
regular basis. 


Source: GAO. | GAO-19-297 
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This report is a public version of a sensitive report that we issued on 
November 20, 2018, which examined the efforts that U.S. Immigration 
and Customs Enforcement (ICE) has taken since our 2012 report to 
address fraud risks, including the extent to which ICE has (1) taken steps 
to strengthen its management of fraud risks in the Student and Exchange 
Visitor Program (SEVP), (2) implemented controls to address fraud risks 
in the school certification and recertification processes, and (3) 
implemented fraud risk controls related to the eligibility, suitability, and 
training of Designated School Officials (DSO).The sensitive report 
included information related to SEVP internal controls used to help 
prevent and identify noncompliance or fraud in the program.' The 
sensitive report also discussed some planned actions to improve these 
internal controls, some of which the Department of Homeland Security 
(DHS) deemed to be sensitive and must be protected from public 
disclosure. This public report omits the information that DHS deemed to 
be sensitive including details associated with (1) the oversight of schools 
during the certification and recertification process, (2) our covert testing of 
SEVP certification internal controls, and (3) current and planned actions 
to oversee DSOs. Although the information provided in this report is more 
limited, it addresses the same objectives and uses the same methodology 
as the sensitive report. 


For our first objective, to evaluate the extent to which ICE has taken steps 
to strengthen its management of fraud risks in SEVP, we assessed 
actions ICE, particularly SEVP and the Counterterrorism and Criminal 
Exploitation Unit (CTCEU), have taken since 2012 to design and 
implement controls to address fraud in the postsecondary, vocational, and 
English language school certification and recertification process. We 
reviewed documents including regulations, processes and procedures, 
and guidance related to fraud risk management, school certification, and 
recertification processes, and the role of DSOs. We evaluated the extent 
to which ICE’s practices were consistent with Standards for Internal 
Control in the Federal Government and GAO’s A Framework for 


'GAO, Student and Exchange Visitor Program: DHS Can Take Additional Steps to 
Manage Fraud Risks Related to School Recertification and Program Oversight, 
GAO-19-133SU (Washington, D.C.: Nov. 20, 2018). 


Although SEVP-certified schools span all education levels, including kindergarten and K- 
12, these schools were excluded from the scope of our work. 
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Managing Fraud Risks in Federal Programs.° In particular, we analyzed 
ICE documentation, such as standard operating procedures, policy 
statements, and guidance for adjudicators to determine how ICE’s 
processes and systems identify and assess risk in SEVP, including the 
SEVP Risk Assessment Model and Framework, Risk Assessment Tool, 
Risk Register, and other internal guidance. In addition, we reviewed 
information from ICE’s current SEVP administrative, watch, and criminal 
investigative cases and analyzed information on past cases of SEVP 
fraud, including indictments. 


Also, we interviewed ICE officials within SEVP to evaluate the extent to 
which the program has taken steps to strengthen its management of fraud 
risks since 2012. We met with senior officials from SEVP, including 
SEVP’s Director and management of the Risk Management Support 
Team, School Certification Unit (Certification Unit), Analysis and 
Operations Center (Compliance Unit), Policy Team, and Field 
Representative Unit. We interviewed officials from ICE’s Office of the 
Principal Legal Advisor to discuss regulatory priorities and legal 
authorities related to fraud prevention and detection. We also interviewed 
officials from ICE’s Identity Benefit Fraud Unit and Domestic Operations 
to discuss their roles in SEVP-related fraud prevention. In addition, we 
met with officials from CTCEU headquarters, including the Student and 
Exchange Visitor Information System Exploitation Section and criminal 
investigators from 5 of the 26 ICE field offices to discuss past cases of 
SEVP-related fraud and steps taken to identify and prioritize fraud risk. 
We visited ICE field offices in Washington, D.C.; Los Angeles and San 
Francisco, California; Newark, New Jersey; and New York, New York. We 
selected these locations based on a mix of criteria, including the following 
characteristics: (1) number of ongoing investigations of certified schools; 
(2) reported previous and current experience investigating SEVP-related 
fraud; (3) number of field representatives assigned to or located near the 
field office; and (4) number of schools that were located proximate to the 
field office and that were either pending recertification, as of July 2017, or 
have been recertified since August 2016. As we did not select a 
probability sample of ICE field offices to interview, the results of these 
interviews cannot be generalized to all of ICE’s 26 field offices. However, 
the interviews provided us with perspectives of ICE officials responsible 
for conducting school fraud investigations, including their views on the 


3GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 
(Washington, D.C.: September 2014); A Framework for Managing Fraud Risks in Federal 
Programs, GAO-15-593SP (Washington, D.C.: July 2015). 
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process SEVP has established for certifying and monitoring schools, 
fraud, and national security vulnerabilities related to foreign students, and 
any challenges field offices have faced in their investigations. 


We conducted a network analysis utilizing both public and proprietary 
information associated with currently certified schools to determine the 
potential to utilize additional data analytics to aid fraud risk-management 
efforts in SEVP.* To develop this analysis, we identified a list of schools 
that, as of July 2017, had been identified by ICE as either being under 
active criminal investigation or subject to additional oversight or 
administrative action due to compliance concerns. We also selected a list 
of SEVP-certified postsecondary schools without such identified concerns 
as of September 2017. We restricted our set of schools to those with at 
least 20 foreign students as of September 2017. In total, 2,439 schools 
comprising 170 with concerns and 2,269 without such concerns were 
analyzed. We then used an outside vendor to provide public and 
proprietary information such as descriptive information associated with 
these schools including addresses, businesses, and past executives. 
Using these data, we used network-analysis techniques to identify 
connections between both those schools with criminal or compliance 
concerns and schools without such identified concerns. We determined 
whether each of the postsecondary schools without compliance concerns 
were linked to any of those with compliance concerns via executive 
employment. Specifically, we identified instances in which an official 
associated with a school with criminal or compliance concerns was 
associated with another school not identified as having those concerns. 
The underlying logic behind this focus was that schools associated with 
an official linked to a school of concern may potentially indicate the need 
for further review of possible criminal or compliance concerns. To further 
validate this information, we conducted additional research using 
investigative databases and the Internet to try to verify the instances 
identified in our analysis such as by ensuring the time frames of the 
connection appeared relevant or to verify the identity of individuals and 
schools involved. While such connections are not proof of criminal or 


4Network analysis is a set of quantitative and graphical methods to identify the underlying 
patterns and structures in a complex set of relationships among many entities such as 
countries, organizations, or individuals. 
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compliance problems, they may potentially be indicative of them. This is a 
diagnostic that has been used in other fraud-related network research.°® 


For our second objective, to evaluate the extent to which ICE has 
implemented controls to address fraud risks in the school certification and 
recertification processes, we assessed documentation describing SEVP’s 
school certification and recertification controls, interviewed headquarters 
and selected field-office ICE officials, and analyzed agency-provided 
recertification data. Specifically, we assessed SEVP’s standard operating 
procedures, including its Adjudicator’s Manual, training materials, and 
other guidance to determine whether the certification and recertification 
controls described in these documents addressed the high-risk indicators 
ICE identified in its Risk Assessment Tool. We used this analysis to 
determine any potential noncompliance and fraud vulnerabilities in these 
controls. We also assessed SEVP’s controls in these areas against 
Standards for Internal Control in the Federal Government related to risk 
management, as well as principles of the Framework for Managing Fraud 
Risks in the Federal Government.® Additionally, we interviewed ICE 
officials in SEVP’s Certification Unit, which is responsible for adjudicating 
certification and recertification petitions, and the Compliance Unit, which 
is charged with monitoring schools for ongoing compliance with regulatory 
record-keeping and reporting requirements. To understand how ICE 
Homeland Security Investigations agents in the field offices work with 
officials in SEVP and the CTCEU to investigate school fraud, we 
conducted semistructured interviews with ICE agents in five field offices. 
We also interviewed ICE officials from SEVP’s Field Representative Unit 
as well as eight field representatives assigned to or located near the 
selected field offices to gather information on the representatives’ roles 
and activities in identifying and reporting potential school fraud. 


Further, we conducted covert testing of SEVP’s internal control activities 
related to the school certification process. Specifically, we submitted 
certification petitions and conducted other covert investigative work for 
three fictitious schools, each of which are subject to particular petition 
requirements. 


5Bart Baesens, Veronique Van Vlasselaer, and Wouter Verbeke, Fraud Analytics: Using 
Descriptive, Predictive, and Social Network Techniques (Hoboken, New Jersey: Wiley, 
2015). 


8GAO-14-704G and GAO-15-593SP. 
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For one of the fictitious schools, we tested SEVP certification controls that 
require schools to submit complete documentation by submitting a 
petition for the school that was missing several of the required 
documents.’ For our second school, we tested SEVP controls requiring 
schools to schedule and complete a site visit conducted by an SEVP field 
representative, by submitting a completed petition for the accredited 
business school, but avoiding the site visit and requesting that our 
paperwork move forward without it. 


For our third fictitious school, we submitted a petition and participated in a 
site visit with SEVP officials, using a rented space as a fictitious school 
location. We tested SEVP controls related to verifying petition 
documentation, and whether SEVP site-visit officials followed established 
procedures for the site visit. 


For all three petitions, we used publicly available information to construct 
our scenarios. We then documented any actions taken by SEVP on the 
submitted petitions, such as completeness checks, investigative steps, 
adjudication decisions or requests to provide additional supporting 
documentation, among other things. Results for all three covert tests, 
while illustrative, cannot be generalized to the full population of petitions. 


For our third objective, to determine the extent to which ICE implemented 
fraud risk controls related to the eligibility and suitability of DSOs, we 
assessed guidance, training, and policies related to DSOs. Specifically, 
we reviewed regulations for DSO eligibility and SEVP guidance and 
standard operating procedures to determine whether supporting evidence 
provided to meet these requirements is being verified, including the Field 
Representative Unit's Site Visit Standard Operation Procedure and the 
Certification Unit’s Adjudicator’s Manual. We evaluated the extent to 
which ICE’s practices for verifying eligibility were consistent with the 
Framework for Managing Fraud Risks in the Federal Government.® In 
addition, we reviewed the current and planned documentation and 


7SEVP requires M schools to provide a completed Form I-17 and documentation on 
Designated School Officials (DSO), payment, state recognition and exemption, evidence 
in lieu of accreditation, teacher qualifications, financials, facilities, attendance policy, 
grading policy, programs of study statement, and ownership. Our petition omitted the 
following documentation: evidence of state licensure or exemption, student letters of 
support, teacher qualifications, evidence in support of facilities, evidence of attendance 
policies, evidence of grading policies, and evidence in support of the programs of study. 


8GAO-15-593SP. 
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procedures on ICE’s existing and planned background checks, including 
the existing documentation for DSO vetting against relevant databases, 
initial requirements for planned biometric screening, and a draft policy 
document for the planned checks. To gather additional perspectives, we 
interviewed ICE officials in headquarters and selected field offices. We 
also interviewed selected DSOs in the field. We identified leading 
practices for project planning in the Project Management Institute’s A 
Guide to the Project Management Body of Knowledge.? In addition, we 
reviewed the best practices associated with developing and maintaining a 
reliable, high-quality schedule in the GAO Schedule Assessment Guide. '° 


In assessing current training and oversight for DSOs, we examined 
guidance, policies, and procedures for the SEVP Field Representative 
Unit and CTCEU’s Project Campus Sentinel. We assessed the 
implementation of these controls against criteria in Standards for Internal 
Control in the Federal Government and A Framework for Managing Fraud 
Risks in Federal Programs. We reviewed DSO training materials, 
including the Online Training for DSOs and the Study in the States 
website. To determine how ICE identifies fraud risk associated with 
DSOs, the controls in place for addressing and mitigating these risks, and 
its efforts to identify potential vulnerabilities in its controls, we met with 
ICE officials at headquarters and five selected field offices, as discussed 
above. To identify the extent to which they have DSO training and 
antifraud responsibilities and requirements, we interviewed selected field 
representatives. Furthermore, we interviewed DSOs at 17 selected 
certified postsecondary schools on their roles and responsibilities and 
training resources. We selected these officials because, as of September 
2017, they constituted a group of representatives from certified schools of 
various types and sizes and were located in proximity to our previously 
selected ICE field-office locations. As we did not select a probability 
sample of DSOs to interview, the information we obtained from these 
school officials cannot be generalized. These interviews provided us with 
the perspectives of DSOs on their roles and responsibilities, training, and 
fraud risks within the program. Further, we interviewed officials from 
NAFSA, an association of international educators, to discuss the 
organization’s views on fraud risks within SEVP, and we reviewed an 


°Project Management Institute, A Guide to the Project Management Body of Knowledge 
(PMBOK® Guide), Sixth Edition. (2017). 


1°GAO, Schedule Assessment Guide: Best Practices for Project Schedules, GAO-16-89G 
(Washington, D.C.: December 2015). 
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extract from the NAFSA Advisor’s Manual of federal regulations affecting 
foreign students and scholars. 
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GAO’s A Framework for Managing Fraud Risks in Federal Programs 
states that, in planning the fraud risk assessment, effective managers 
tailor the assessment to the program by, among other things, identifying 
appropriate tools, methods, and sources for gathering information about 
fraud risks and involving relevant stakeholders in the assessment process 
(see fig. 11). 
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Figure 11: Key Elements of the Fraud Risk Assessment Process 
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Identify inherent fraud risks affecting the program 
Managers determine where fraud can occur and the types of fraud the program faces, such 
as fraud related to financial reporting, misappropriation of assets, or corruption. Managers 
may consider factors that are specific to fraud risks, including incentives, opportunity, and 
e rationalization to commit fraud. 
@ 


SS 


Assess the likelihood and impact of inherent fraud risks 


Managers conduct quantitative or qualitative assessments, or both, of the likelihood and 
impact of inherent risks, including the impact of fraud risks on the program’s finances, 
reputation, and compliance. The specific methodology managers use to assess fraud 
risks can vary by program because of differences in missions, activities, capacity, 


@ @ and other factors. 


=), Determine fraud risk tolerance 
According to Standards for Internal Control in the Federal Government,? risk tolerance is the 
acceptable level of variation in performance relative to the achievement of objectives. In the 
context of fraud risk management, if the objective is to mitigate fraud risks—in general, to have 
Prioritized a very low level of fraud—the risk tolerance reflects managers’ willingness to accept a higher 
Residual level of fraud risks, and it may vary depending on the circumstances of the program. 


Risks O © 


Examine the suitability of existing fraud controls 

and prioritize residual fraud risks 

Managers consider the extent to which existing control activities mitigate the likelihood and 
impact of inherent risks. The risk that remains after inherent risks have been mitigated by existing 


4 
control activities is called residual risk. Managers then rank residual fraud risks in order of priority, 


4 


using the likelihood and impact analysis, as well as risk tolerance, to inform prioritization. 


wy -¥, Document the program’s fraud risk profile 
Effectively assessing fraud risks involves documenting the key findings and conclusions from 
the actions above, including the analysis of the types of fraud risks, their perceived likelihood 

and impact, risk tolerance, and the prioritization of risks. 


Source: GAO. | GAO-19-297 
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*GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: 
Sept. 10, 2014), 6.08. 
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On the basis of our analysis of U.S. Immigration and Customs 
Enforcement (ICE) data, the Student and Exchange Visitor Program 
(SEVP) withdrew certification for approximately 2,600 schools during the 
period of fiscal years 2013 through 2017 (see fig. 12). The Enhanced 
Border Security and Visa Entry Reform Act of 2002 states that a material 
failure of an SEVP-certified school to comply with the record-keeping and 
reporting requirements to receive nonimmigrant students shall result in 
the suspension for at least 1 year, or termination, of the school’s approval 
to receive such students.’ Under federal regulation, SEVP can deny an 
SEVP-certified school’s recertification petition or, as a result of a 
subsequent out-of-cycle review, can withdraw certification, if the school or 
its programs are no longer eligible for certification.” 


'g U.S.C. § 1762. 
28 C.F.R. §§ 214.3(e)(5), (h)(2), (h)(3), 214.4(a), (b). 
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Figure 12: Number and Type of Certification Withdrawals, Fiscal Years 2013-2017 
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Source: GAO analysis of Student and Exchange Visitor Program data. | GAO-19-297 


Denial of recertification or withdrawal on notice as a result of out-of-cycle 
review may be for any valid and substantive reason, including failure to 
comply with record-keeping and reporting requirements, willful issuance 
by a DSO of a false statement, or not operating as a legitimate institution, 
among other bases. According to SEVP officials, denials resulting from 
recertification reviews are often based on historical discrepancies in the 
DSO’s data entry, record-maintenance and Form I-20 issuance issues, or 
a negative change in the school’s operating status, such as a loss of state 
licensure. By regulation, an appeal of a notice of denial or withdrawal 
must be made within 15 days after service of the decision.* Schools 


38 C.F.R. § 214.4(a). The regulation provides that a school’s recertification petition may be 
denied or certification may be withdrawn on notice (after out-of-cycle review) “if the school 
or school system is determined to no longer be entitled to certification for any valid and 
substantive reason including, but not limited to, the following” listed grounds. Id. 


48 C.F.R. § 214.4(h). 
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denied recertification must, according to regulations, wait at least 1 
calendar year from the date of denial of recertification or withdrawal 
notice before being eligible to petition again for certification.® 


If, upon the completion of an out-of-cycle review, SEVP determines that a 
school has failed to sustain eligibility or has failed to comply with the 
record-keeping, retention, reporting, or other requirements, SEVP will 
institute withdrawal proceedings by serving the school a notice of intent to 
withdraw SEVP certification.® Failure of a school to respond to a notice of 
intent to withdraw within 30 days will result in an unappealable withdrawal 
of the school’s certification.” At the conclusion of withdrawal proceedings, 
a school found to be ineligible for continued SEVP certification as a result 
of an out-of-cycle review will receive a notice of withdrawal.® SEVP 
withdrew on notice approximately 211 certifications from fiscal years 2013 
through 2017 (see fig. 12). If SEVP staff identify an issue during an out- 
of-cycle review that seems to be an error not warranting withdrawal, 
SEVP could issue a Remedial Action Plan to the school describing the 
issues it needs to address to retain its program eligibility. According to 
SEVP officials, once they have gathered enough evidence and made the 
decision to withdraw the school’s certification, SEVP can temporarily 
terminate the school’s ability to issue Forms I-20 to students. For 
example, SEVP officials explained that if a school that is otherwise in 
compliance lets its accreditation lapse, SEVP may revoke its authority to 
issue Forms I-20 until it renews its accreditation. 


Regarding automatic withdrawals, SEVP will serve a notice of intent to 
withdraw SEVP certification to the school 30 days prior to its certification 
expiration date if, up until that point the school has failed to file a 
complete petition for recertification.? From fiscal year 2013 through fiscal 
year 2017, SEVP automatically withdrew 1,763 certifications (see fig. 12). 
SEVP will not accept a petition for recertification and the school will be 
automatically withdrawn immediately if such school has effectively 
relinquished its SEVP certification by not petitioning for recertification, 
abandoning its petition, or not submitting a complete recertification 


5See id. § 214.4(a)(2). 

68 C.F.R. § 214.3(e)(4)(ii), (h)(3)(vi). 
7See id. § 214.3(e)(4)(ii). 

8Id. at § 214.3(e)(7). 

°8 C.F.R. § 214.3(e)(4), (h)(2)(ii). 
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package by the certification expiration date. '° Certified schools can also 
voluntarily withdraw their certification at any time. 


See id. §§ 214.3(e)(4), (e)(6), (h)(2)(ii), 214.4(a)(3). 
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U,S. Department of Homeland Security 
Washington, DC 20528 
PARTAr, 


er. Homeland 
S Security 


February 6, 2019 


Rebecca Shea 

Director, Forensic Audits and Investigative Service 
U.S. Government Accountability Office 

441 G Street, NW 

Washington, DC 20548 


Rebecca Gambler 

Director, Homeland Security and Justice 
U.S. Government Accountability Office 
441 G Street, NW 

Washington, DC 20548 


Re: Management’s Response to Draft Report GAO-19-297, “STUDENT AND 
EXCHANGE VISITOR PROGRAM: DHS Can Take Additional Steps to 
Manage Fraud Risks Related to School Recertification and Program Oversight” 


Dear Ms. Shea and Ms. Gambler: 


Thank you for the opportunity to review and comment on this draft report. The U.S. 
Department of Homeland Security (DHS) appreciates the U.S. Government 
Accountability Office’s (GAO) work in planning and conducting its review and issuing 
this report. 


The Department is pleased to note GAO’s positive recognition of U.S. Immigration and 
Customs Enforcement (ICE) Student and Exchange Visitor Program (SEVP) actions 
taken to close the eight recommendations from a 2012 report! and the development of 
various tools designed to strengthen fraud risk-management efforts. These include steps 
SEVP took to improve school certification controls and processes, which GAO 
independent covert testing found were being followed. 


DHS remains committed to protecting national security by ensuring that students, 
visitors, and schools comply with U.S. immigration laws. ICE SEVP supports this effort 
by collecting, maintaining, and analyzing information so only legitimate nonimmigrant 
students or exchange visitors gain entry into the United States though this program, and 


' GAO, “Student Exchange Visitor Program: DHS Needs to Assess Risks and Strebgthen Oversight Functions,” 
GAO-12-572 (Washington, D.C.: June 18, 2012). 
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ensuring the institutions accepting them are certified and follow the governing federal 
rules and regulations. 


The draft report contained seven recommendations with which the Department concurs. 
Attached find our detailed response to each recommendation. Technical comments were 
previously provided under separate cover. 


Again, thank you for the opportunity to review and comment on this draft report. Please 
feel free to contact me if you have any questions. We look forward to working with you 


again in the future. 
Sincerely, 


N AQ ia 


JIM H. CRUMPACKER, CIA, CFE 
Director 
Departmental GAO-OIG Liaison Office 


Attachment 
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Attachment: Management Response to Recommendations 
Contained in GAO-19-297 


GAO recommended that the Director of the U.S. Immigration and Customs Enforcement 
(ICE): 


Recommendation 1: Develop a fraud risk profile that aligns with leading practices and 


Identifies inherent fraud risks affecting the program, 

Assesses the likelihood and impact of inherent fraud risks, 

Determines fraud risk tolerance, 

Examines the suitability of existing fraud controls and prioritizes residual fraud 
risks, including residual risks posed by the recertification queue. 


Response: Concur. ICE Student and Exchange Visitor Program (SEVP) will design and 
implement a Fraud Risk Framework. As part of the Fraud Risk Framework, SEVP will 
develop a fraud risk profile by identifying fraud risks affecting the program, assessing 
their impact and likelihood, determining the program’s risk tolerance, and examining the 
suitability of SEVP’s existing fraud controls to prioritize residual risks. Specificallly, 
SEVP will: 


1) Complete information gathering from all stakeholders to identify, gather, and 
document fraud risks within the fraud risk categories no later than (NLT) 
September 30, 2019; 

2) Compile information from stakeholders to establish SEVP’s Fraud Risk Profile 
NLT December 31, 2019; and 

3) Complete discussions on risk responses and adapt risk responses as necessary 
NLT February 28, 2020. 


Estimated Completion Date (ECD): March 31, 2020. 


Recommendation 2: Build on existing efforts to use data analytics by employing 
techniques, such as network analysis, to identify potential fraud indicators in schools 
petitioning for certification. 


Response: Concur. ICE SEVP is working to procure external services to assist with 
identification of potential early fraud indicators in schools petitioning for certification or 
already certified. The services procured will assist with the identification of risk 
indicators found in public records and open source information. This will help SEVP 
evaluate in-depth analytics through trained experts. ECD: March 31, 2019. 
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Recommendation 3: Begin notifying certified schools 180 days prior to, and requiring 
submission of complete recertification petitions by, the 2-year certification expiration 
date, consistent with regulation, and evaluate whether additional resources are needed. 


Response: Concur. ICE SEVP will hire additional adjudicators and implement a revised 
two-year recertification process in two stages: 


1) SEVP is currently conducting interviews to hire for 12 vacant adjudicator 
positions. SEVP anticipates having new adjudicators hired by March 31, 2019 and 
onboard by June 30, 2019. 


2) Following the addition of new staff, SEVP will implement a revised two-year 
recertification process via a systematic Certification Expiration Date (CED) 
implementation process. This change will require a robust communications plan 
between SEVP and the academic community. To accomplish this, SEVP will 
develop a communications plan NLT September 30, 2019, and systematically send 
certification notifications based on CED’s NLT March 30, 2020. 


ECD: October 31, 2020. 


Recommendation 4: As practicable, verify the eligibility information provided to 
establish the immigration or citizenship status of lawful permanent residents and 
naturalized U.S. citizens, as well as U.S.-born citizens, who have been nominated or 
renominated to serve as DSOs [designated school officals]. 


Response: Concur. ICE SEVP will work with U.S. Citizenship and Immigration 
Services (USCIS) to establish a process to verify eligibility information for lawful 
permanent residents and naturalized U.S. citizens. To verify eligibility, SEVP will 
require access to the USCIS Computer Linked Application Information Management 
System and the Central Index System. ECD: October 31, 2019. 


Recommendation 5: Develop an implementation plan for the project aimed at 
strengthening background checks for DSOs; that plan should outline how the project will 
be executed, monitored, and controlled. 


Response: Concur. ICE SEVP will develop an implementation plan for the project on 
DSO background (suitability) checks to document how the project will be executed, 
monitored, and controlled. The implementation plan will identify milestones, such as the 
execution of inter-agency agreements with Transportation Security Administration and 
ICE’s Office of Professional Responsibility. These agreements will identify the roles and 
responsibilities of the participants, as well as establish milestones for creating vetting 
criteria, drafting of implementing regulation, and other significant requirements. In 
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preparing the implementation plan, SEVP will leverage the best practices set forth in the 
Project Management Institute’s A Guide to the Project Management Body of Knowledge 
as noted in this draft report. ECD: October 31, 2019. 


Recommendation 6: Implement mandatory DSO training and verify that the training is 
completed. 


Response: Concur. ICE SEVP is working towards implementing mandatory DSO 
training and tracking compliance. SEVP currently has a contract in place whose primary 
function is to develop training needed for SEVP. The contract will be modified to 
include the requirement of developing an advanced DSO training course. The target 
award date for the contract is March 31, 2019. The SEVP School Certification Unit 
(SCU) and Systems Management Unit (SMU) will work together with the contractor to 
guide the development of this training course with the goal of implementing the course 
by March 31, 2020. SEVP SMU and SCU will work with the SEVP Strategic 
Communications Team (SCT) to develop a communications plan that will be distributed 
to the academic community. ECD: March 31, 2020. 


Recommendation 7: Complete the development and implementation of its plans for 
mandatory fraud-specific training to DSOs. 


Response: Concur. ICE SEVP will develop and implement a mandatory fraud-specific 
training course for DSOs. SEVP currently has a contract in place whose primary 
function is to develop training needed for SEVP. SEVP is currently modifying this 
contract to include the creation of an advanced fraud-specific training course and 
anticipates making an award by March 31, 2019. SEVP SCU and SMU are currently 
working together with the contractor to guide the development of this training course. 
This new training course will explain the importance of accurate and timely reporting of 
data. Closer to implementation, SEVP SMU and SCU will work with the SCT to develop 
a communications plan for the academic community. ECD: October 31, 2019. 
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